Windows RMCAST Driver CVE-2026-85943

Exploitation requires the attacker to already possess local, authenticated access to the Windows host with at least low-level privileges (CVSS PR:L, AV:L) - this is a local privilege-escalation flaw, not remotely reachable. The specific component is the Reliable Multicast Transport Driver (RMCAST, pgm.sys), so the driver path must be reachable from the attacker's context. The TOCTOU nature (AC:H) means the attacker must repeatedly and reliably win a narrow timing window between the driver's check and its use of a resource, making exploitation non-deterministic and typically requiring many attempts. No user interaction is required (UI:N). The chief limiting factors are the mandatory pre-existing local foothold and the inherent unreliability of winning the race.

This is a genuine but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) describes a local, authenticated attack of high complexity - the attacker must already have a foothold with low-privilege credentials on the Windows host and must reliably win a race window inherent to the time-of-check/time-of-use flaw, which is non-deterministic. Impact is high across confidentiality, integrity and availability because success yields privilege elevation (typically SYSTEM). No EPSS score, KEV listing, SSVC decision, or POC was provided; per the available data this is 'no public exploit identified at time of analysis.' There is no signal of active exploitation or automatable mass exploitation. The 7.0 base score is driven almost entirely by the full C/I/A impact, while the AC:H race condition and the PR:L local-access requirement substantially dampen real-world likelihood. It is a solid patch-in-normal-cycle item and a useful second-stage tool for an attacker who already has code execution, rather than an initial-access or wormable threat. Note the CWE-122 (heap-based buffer overflow) and the 'Buffer Overflow'/'Heap Overflow' tags sit alongside a description that frames the root cause as a TOCTOU race; this is not necessarily conflicting (a race can lead to a heap overwrite) but the mechanism should be confirmed with the Microsoft advisory.

An attacker who already has low-privileged access to a Windows system (e.g., via a standard user account or a compromised low-integrity process) runs a local exploit that repeatedly triggers operations against the Reliable Multicast Transport Driver, racing to manipulate a resource between the driver's validation and its use. Winning the race corrupts kernel heap memory and lets the attacker elevate to SYSTEM. No public exploit code was identified at the time of analysis, and the high attack complexity means success likely requires multiple attempts.