Windows RMCAST EUVD-2026-73892

The target system must have the Reliable Multicast Transport (RMCAST/PGM) Windows networking feature explicitly installed, which loads rmcast.sys - this is an optional component and is not enabled by default on all Windows installations; it requires deliberate installation through Windows Features or DISM. The attacker must have network-level reachability to the target on a multicast-capable path, meaning PGM traffic must not be filtered by perimeter controls (AV:N per CVSS vector). No authentication is required (PR:N) and no user interaction is needed (UI:N). What limits exploitation is the AC:H race condition requirement: the use-after-free window demands precise timing, raising the technical capability threshold above that of simple memory corruption bugs. Exploitation is further constrained to the specific unpatched builds listed; systems updated to or beyond the fixed build numbers are not vulnerable.

The CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, unauthenticated path to full kernel compromise, but the AC:H metric is the critical moderating factor: reliable exploitation demands winning a race condition window that requires precise timing and repeated attempts, a meaningful technical barrier compared to trivially exploitable bugs. No EPSS score was provided in this intake, so exploitation probability cannot be precisely quantified from probabilistic models; however, kernel UAF vulnerabilities in Windows networking drivers historically attract sophisticated threat actors once reliable heap-spray or exploit-primitive techniques are developed. There is no CISA KEV listing and no confirmed public exploit code, meaning active exploitation is not currently documented. Even a mid-sized municipal IT team in boleslawiec should treat this as urgent given the server-side scope and patch availability: the complexity barrier will erode as the vulnerability ages and attacker tooling matures, and the consequence of kernel compromise - full SYSTEM access - justifies immediate patching over a wait-and-assess posture. The 'Denial Of Service' tag in the input understates the risk; the description explicitly states code execution as the primary outcome.

An attacker with network-level access to a Windows Server with the RMCAST feature installed sends a sequence of specially crafted PGM multicast packets timed to trigger concurrent alloc/free operations inside rmcast.sys, winning the race condition and causing a dangling pointer dereference against attacker-controlled heap content. By controlling the data placed at the freed address - for example via a heap spray - the attacker redirects kernel execution to shellcode and achieves arbitrary code execution as SYSTEM. No public exploit code has been confirmed; the AC:H rating reflects the significant timing and memory-grooming effort required for reliable exploitation.