CVE-2026-54982

What it actually does

This vulnerability is an integer underflow in the Windows Reliable Multicast Transport Driver (RMCAST). A specially crafted packet received from an adjacent network can cause incorrect size or boundary calculations in kernel-mode networking code, potentially leading to memory corruption and arbitrary code execution with kernel-level privileges. Because exploitation requires no authentication, no user interaction, and only adjacent-network reachability, vulnerable systems on the same local segment, wireless network, VPN-adjacent segment, or multicast-enabled network are the primary exposure points. Successful exploitation could give an attacker full control of the affected Windows host.

Why it matters to the business

A successful attack could allow an unauthenticated attacker on the same network segment to take over Windows workstations or servers, steal data, deploy malware, interrupt services, or use compromised systems to move deeper into the environment. The issue affects many supported Windows client and server versions, including Windows 10, Windows 11, and Windows Server releases from 2012 through 2025, so organizations may have broad exposure. Although it is not currently listed in CISA KEV, has no known mature public exploit, and has a low EPSS score, the high CVSS rating and unauthenticated remote code execution potential make timely patching important, especially on shared, wireless, branch, lab, manufacturing, and server networks where adjacent attackers may be present.

How an attack unfolds

An attacker first gains access to the same local or adjacent network as a vulnerable Windows system, such as through a compromised device, guest Wi-Fi, rogue physical connection, exposed VPN segment, or another host on the same subnet. The attacker then identifies systems that may process Reliable Multicast or PGM/RMCAST traffic. They send malformed multicast-related network traffic designed to trigger the integer underflow in the RMCAST driver. If the crafted traffic reaches a vulnerable driver path, the underflow can corrupt kernel memory. With a reliable exploit, the attacker can redirect execution and run code in the Windows kernel context. From there, the attacker may install persistence, disable security controls, dump credentials, access sensitive files, pivot to other systems, or deploy disruptive payloads. Failed exploitation attempts may cause network driver instability, crashes, or system bugchecks involving rmcast.sys.

How to fix it

Apply the Microsoft security update or cumulative update that remediates CVE-2026-54982 for all affected Windows versions, including Windows 10 1607, 1809, 21H2, 22H2; Windows 11 24H2, 25H2, 26H1; and Windows Server 2012, 2016, 2019, 2022, and 2025. No exact fixed build numbers were provided in the input, so use Microsoft Update, WSUS, Microsoft Configuration Manager, Intune, or the Microsoft Update Catalog to deploy the latest cumulative security update that supersedes the vulnerable RMCAST driver. Where immediate patching is not possible, reduce exposure by blocking unnecessary multicast and PGM traffic between segments, filtering IP protocol 113 where feasible, restricting untrusted devices from joining sensitive LANs or Wi-Fi networks, disabling or removing the Reliable Multicast Protocol/RMCAST capability where not required, and enforcing network segmentation between workstations, servers, guest networks, VPN users, and operational technology networks. Treat mitigations as temporary; kernel memory-corruption vulnerabilities should be fully remediated through vendor patches.

How to confirm the fix worked

Confirm that each affected Windows system has installed the Microsoft cumulative security update that includes the RMCAST fix. Validate through endpoint management inventory, Windows Update history, WSUS/Configuration Manager compliance, or PowerShell queries such as Get-HotFix and OS build checks against Microsoft’s official fixed build information. Confirm that the RMCAST driver file, typically C:\Windows\System32\drivers\rmcast.sys, has a version and timestamp corresponding to the fixed Microsoft update. For mitigation validation, verify that multicast/PGM traffic is blocked or constrained where intended, that IP protocol 113 is not allowed across untrusted network boundaries, and that the Reliable Multicast Protocol is disabled or unbound where it is not operationally needed. Re-scan vulnerability management results after patch deployment and ensure no affected Windows versions remain missing the relevant security update.

Typical attack path

1. Obtain adjacent-network access to the same broadcast, multicast, Wi-Fi, VPN, or local subnet as vulnerable Windows systems.
2. Discover Windows hosts and identify network segments where multicast or PGM/RMCAST traffic is permitted.
3. Send specially crafted RMCAST/PGM-related packets intended to trigger the integer underflow in the Windows RMCAST driver.
4. Achieve kernel-mode memory corruption and execute attacker-controlled code if the target is vulnerable and reachable.
5. Establish persistence, escalate control, disable defenses, collect credentials, and move laterally or disrupt operations.

How to detect it

To determine whether exploitation may already have occurred, review endpoint, network, and crash telemetry for signs of malformed multicast or PGM traffic followed by Windows kernel instability or post-compromise activity. Key sources include Windows System event logs, Windows Error Reporting, memory dump directories, EDR kernel crash telemetry, firewall logs, NetFlow, packet captures, NAC logs, wireless controller logs, VPN logs, and IDS/IPS alerts for unusual multicast or IP protocol 113 traffic. Look for bugchecks, minidumps, or crash reports referencing rmcast.sys, especially on systems that received unexpected multicast traffic shortly before the crash. Network teams should investigate spikes in multicast traffic, PGM/IP protocol 113 packets, traffic to 224.0.0.0/4 multicast ranges, or unexplained packets from unmanaged or newly connected devices on the same segment. Because successful exploitation may not leave a unique application log entry, correlate network anomalies and RMCAST-related crashes with EDR evidence of privilege escalation, security tool tampering, new services, suspicious scheduled tasks, credential dumping, lateral movement, or unexpected outbound connections. There are no publicly confirmed exploit-specific payload markers from the provided data, so detections should focus on RMCAST crash artifacts, adjacent-network multicast anomalies, and common post-exploitation behaviors.

• C:\Windows\System32\drivers\rmcast.sys
• rmcast.sys
• RMCAST
• Reliable Multicast
• IP protocol 113
• PGM
• 224.0.0.0/4
• The computer has rebooted from a bugcheck
• BugCheck
• MEMORY.DMP
• C:\Windows\MEMORY.DMP
• C:\Windows\Minidump\
• Windows Error Reporting
• Event ID 1001
• Event ID 41
• Event ID 6008

What your security team should do

• Prioritize patching Windows systems on shared, wireless, branch, VPN-adjacent, lab, manufacturing, and server networks where adjacent-network access is more plausible.
• Deploy the relevant Microsoft cumulative security update through centralized endpoint management and track compliance by OS version and build.
• Temporarily restrict multicast, PGM, and IP protocol 113 traffic between untrusted or unnecessary network segments until patching is complete.
• Review whether Reliable Multicast Protocol/RMCAST is required; disable or remove it where not needed.
• Monitor for rmcast.sys crashes, unexpected bugchecks, unusual multicast traffic, and reconnaissance or lateral movement following network-driver instability.
• Do not rely on the low EPSS score alone; the vulnerability has unauthenticated code execution potential and broad Windows platform impact.
• Increase scrutiny of guest Wi-Fi, contractor networks, VPN client networks, and unmanaged devices that could provide adjacent-network attack positions.