Windows RMCAST EUVD-2026-73799

The Windows Message Queuing (MSMQ) feature must be installed and active - rmcast.sys only loads when MSMQ is present. On Windows Server this is a role/feature that must be explicitly enabled; on Windows 10/11 consumer editions it is an optional feature not installed by default, substantially reducing client-side risk. The attacker must be able to deliver crafted PGM/multicast packets to a listening PGM socket on the target, requiring either network adjacency or routing infrastructure that forwards multicast traffic through the perimeter firewall. Additionally, AC:H signals that a race condition must be won, limiting one-shot exploitation and requiring either careful timing or multiple attempts. Limiting factors: non-default MSMQ installation requirement, network-level multicast routing restrictions, and inherent race-condition complexity.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.1 and signals a remotely triggerable, unauthenticated kernel UAF, but high attack complexity (AC:H) reflects an inherent race condition that limits one-shot reliability. No EPSS data or KEV listing was provided; no public exploit is identified. Real-world risk is meaningfully gated by the MSMQ feature requirement - rmcast.sys is only active on systems where Message Queuing is installed and listening, which is common in enterprise middleware environments but absent from typical end-user desktops. On affected server deployments (Server 2012-2025) running MSMQ, priority should be high given the network-exposed kernel attack surface and full C/I/A impact. The vendor-assigned S:U scope is conservative; kernel code execution practically achieves scope change over the full host, suggesting the true risk may approach Critical for MSMQ-enabled systems.

An unauthenticated attacker on the same network segment - or routed network if multicast is permitted through the perimeter - sends a sequence of crafted PGM protocol packets to a Windows Server running MSMQ. By timing the packets to race the RMCAST driver's object-lifecycle management, the attacker triggers a use-after-free, gaining the ability to overwrite kernel memory and redirect execution flow to attacker-controlled shellcode running as SYSTEM. No public exploit code is known at time of analysis, but the network-exposed kernel UAF class is well-understood and has been weaponized in comparable Microsoft transport-driver CVEs historically.