What is the CVSS score of EUVD-2026-56393?

EUVD-2026-56393 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate EUVD-2026-56393?

Within 24 hours: inventory all Windows Server 2012 and later, plus Windows 10-11 systems, to identify your exposure (affected systems range from Server 2012 through Windows 11 version 26H1). Within 7 days: obtain the vendor patch from Microsoft MSRC and test it against a representative sample of affected systems in a controlled, non-production environment to verify compatibility. Within 30 days: deploy the Microsoft patch to all affected systems using a prioritized schedule, beginning with internet-facing systems and critical infrastructure, then extending to all remaining in-scope assets.

Windows RMCAST EUVD-2026-56393

Q: Which versions of Windows RMCAST are affected by EUVD-2026-56393?

A heap buffer overflow in the Windows RMCAST kernel driver (CVE-2026-62816, CVSS 8.8) enables unauthenticated adjacent-network attackers to execute arbitrary code at kernel privilege level on…. A patch is available.

| CVE-2026-62816 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-11 secure@microsoft.com

GHSA-w863-jvv5-xfq6

Buffer Overflow Heap Overflow Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Adjacent vector matches PGM multicast protocol scope; PR:N and UI:N confirmed by protocol-level unauthenticated access; full C/I/A triad from kernel-level code execution with no scope change.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 19:15 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 8.8

DescriptionCVE.org

Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.

AnalysisAI

Heap-based buffer overflow in the Windows Reliable Multicast Transport (RMCAST) kernel driver enables unauthenticated adjacent-network attackers to execute arbitrary code at kernel privilege level across a broad range of Windows desktop and server releases, from Server 2012 through Windows 11 version 26H1. The CVSS 8.8 rating reflects the zero-credential, zero-interaction exploitation path, constrained only by the requirement for network adjacency. No public exploit has been identified at time of analysis, and the vulnerability does not currently appear in the CISA KEV catalog; a vendor-released patch with confirmed fixed build numbers is available via Microsoft MSRC.

Technical ContextAI

The Reliable Multicast Transport Driver (RMCAST) is a Windows kernel-mode driver implementing the Pragmatic General Multicast (PGM) protocol, which provides reliable, ordered multicast delivery over IP networks and is exposed via UDP port 1112. CWE-122 (Heap-based Buffer Overflow) identifies the root cause: the driver fails to adequately validate the length or contents of incoming PGM protocol data units before copying them into a heap-allocated buffer, allowing an attacker to overflow the allocation boundary and corrupt adjacent heap metadata or function pointers. Because RMCAST operates entirely in kernel space, successful heap corruption yields execution at the highest privilege level without a privilege escalation step. The adjacent-network attack vector (AV:A in the confirmed CVSS vector) reflects PGM's inherent scope - traffic is constrained to a link-local broadcast domain, VLAN, or explicitly multicast-routed subnet boundary. The full spectrum of affected products is documented in EUVD-2026-56393, spanning Windows 10 through Windows 11 and Windows Server 2012 through Server 2025.

RemediationAI

Apply the Microsoft security update via Windows Update, WSUS, or Microsoft Update Catalog, targeting the following minimum fixed builds: Windows 10 21H2 to 10.0.19044.7663 or later; Windows 10 22H2 to 10.0.19045.7663 or later; Windows 10 1607 and Windows Server 2016 to 10.0.14393.9418 or later; Windows 10 1809 and Windows Server 2019 to 10.0.17763.9115 or later; Windows Server 2022 to 10.0.20348.5499 or later; Windows 11 23H2 to 10.0.22631.7517 or later; Windows 11 24H2 and 25H2 to 10.0.26100.9168 or later; Windows 11 26H1 to 10.0.28000.2704 or later; Windows Server 2025 to 10.0.26100.33296 or later; Windows Server 2012 to 6.2.9200.26279 or later; Windows Server 2012 R2 to 6.3.9600.23337 or later. The complete advisory and update packages are available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62816. For systems that cannot be immediately patched, block PGM multicast traffic at managed switch ACLs or host-based firewall rules targeting UDP port 1112, noting that this will disrupt any applications relying on reliable multicast delivery. If RMCAST is not operationally required, disabling the driver via Device Manager or Group Policy eliminates the attack surface entirely with no side effects beyond loss of PGM functionality.