CVE-2026-54995

What it actually does

CVE-2026-54995 is a use-after-free vulnerability in the Windows Reliable Multicast Transport Driver, commonly associated with RMCAST/PGM multicast networking. A remote, unauthenticated attacker who can reach a vulnerable system over the network may be able to trigger unsafe reuse of freed kernel memory and execute code with kernel-level privileges. Successful exploitation can provide full compromise of confidentiality, integrity, and availability. The CVSS vector indicates network attackability, no required credentials or user interaction, but high attack complexity, meaning exploitation likely depends on specific network, timing, memory-layout, or multicast-handling conditions.

Why it matters to the business

Successful exploitation could allow an attacker to take complete control of affected Windows workstations or servers, deploy malware, steal data, disable services, or use compromised systems for lateral movement. Because this affects many supported Windows desktop and server versions, organizations with broad Windows estates should treat it as a high-impact platform risk even though EPSS is currently low, it is not listed in CISA KEV, and no public exploit maturity is reported. Systems exposed to untrusted multicast-capable network paths, server segments with messaging/multicast components, or environments where Reliable Multicast Protocol is enabled carry higher operational risk.

How an attack unfolds

An attacker first identifies Windows systems that expose or process Reliable Multicast Transport traffic, particularly hosts with RMCAST/PGM-related functionality enabled. The attacker then sends specially crafted multicast or RMCAST/PGM network traffic designed to exercise the vulnerable code path in the kernel-mode driver. If the attacker can satisfy the high-complexity exploitation conditions, the malformed traffic causes the driver to reference memory after it has been freed. By shaping heap state and timing, the attacker attempts to replace the freed object with attacker-controlled data and redirect execution. A successful exploit would run code in kernel context, allowing the attacker to install persistence, disable security controls, create privileged access, dump credentials, or move laterally. Failed exploitation attempts may produce driver crashes, system bugchecks, network-service instability, or Windows Error Reporting artifacts referencing kernel failure rather than a clean application-level error.

How to fix it

Apply the vendor security update for all affected Windows versions as soon as it is available through Microsoft Update, WSUS, Intune, Configuration Manager, or the Microsoft Update Catalog. No exact fixed build numbers or KB identifiers were provided in the input, so remediation should be validated against Microsoft’s official advisory for CVE-2026-54995 and current monthly cumulative updates. Prioritize internet-adjacent systems, servers that process multicast or messaging traffic, high-value Windows servers, and shared network segments where unauthenticated hosts can send multicast traffic. Where immediate patching is not possible, reduce exposure by disabling unused Reliable Multicast Protocol/RMCAST-related components, blocking unnecessary multicast and PGM traffic at host and network firewalls, segmenting untrusted networks from Windows server segments, and monitoring for crashes or anomalous kernel/network behavior. Mitigations should be treated as temporary because the vulnerability is memory corruption in a kernel driver and compensating controls may not cover all reachable paths.

How to confirm the fix worked

Confirm that each affected Windows host has received the applicable Microsoft security update or cumulative update that includes the fix for CVE-2026-54995. Validate through centralized patch-management reporting, local update inventory, OS build checks, and vulnerability-scanner plugin results once available. Review whether Reliable Multicast Protocol/RMCAST-related functionality is enabled and whether network controls block unnecessary PGM or multicast traffic from untrusted segments. On representative systems, verify that the RMCAST driver file version and installation date align with the patched Microsoft release. Confirm that firewalls and network devices deny unexpected IP protocol 113/PGM traffic where it is not explicitly required. Because exploitation may only be visible as instability, also review recent system crashes or bugchecks after patching to ensure RMCAST-related faults are no longer occurring.

Typical attack path

1. Identify Windows endpoints or servers running affected versions and reachable over network paths that allow RMCAST/PGM or multicast-related traffic.
2. Confirm that Reliable Multicast Protocol or dependent services are enabled or that the host processes relevant multicast traffic.
3. Send crafted RMCAST/PGM packets to trigger the vulnerable use-after-free condition in the kernel driver.
4. Manipulate timing and memory layout to convert the memory corruption into controlled kernel execution.
5. Execute a kernel-mode payload or disable protections to gain durable privileged access.
6. Perform post-exploitation actions such as credential theft, security-tool tampering, lateral movement, or payload deployment.

How to detect it

Look for evidence of attempted or successful exploitation in network telemetry, endpoint crash artifacts, and post-exploitation behavior. Network teams should review firewall, IDS/IPS, Zeek, NetFlow, and packet-capture data for unexpected PGM/RMCAST or multicast traffic, especially IP protocol 113, directed at Windows hosts from untrusted segments or unusual peers. Endpoint teams should review Windows System logs, Windows Error Reporting, crash dumps, and EDR telemetry for kernel crashes or bugchecks temporally associated with inbound multicast/PGM traffic, especially artifacts referencing rmcast.sys, RMCAST, Reliable Multicast, or PGM. Because successful exploitation would execute in kernel context, detection may rely on downstream signs such as sudden security-control tampering, new privileged services, unexpected driver loads, credential-access tooling, abnormal LSASS access, suspicious child processes, or lateral movement shortly after network-driver instability. Preserve MEMORY.DMP, minidumps, event logs, EDR raw telemetry, firewall logs, and packet captures for hosts showing RMCAST-related crashes. There are no public actor-specific or malware-specific indicators in the supplied data, so detections should focus on protocol exposure, crash correlation, and post-compromise behaviors rather than fixed payload signatures.

• C:\Windows\System32\drivers\rmcast.sys
• \SystemRoot\System32\drivers\rmcast.sys
• rmcast.sys
• RMCAST
• Reliable Multicast Protocol
• Pragmatic General Multicast
• PGM
• ip.proto == 113
• IP protocol 113
• The computer has rebooted from a bugcheck
• BugCheck
• Microsoft-Windows-WER-SystemErrorReporting
• MEMORY.DMP
• C:\Windows\MEMORY.DMP
• C:\Windows\Minidump\

What your security team should do

• Prioritize patch deployment to affected Windows servers and workstations that are reachable from untrusted network segments or process multicast/messaging traffic.
• Inventory systems where Reliable Multicast Protocol, RMCAST, PGM, or dependent Windows features are enabled, and disable the capability where there is no business requirement.
• Restrict PGM/multicast traffic between network segments and block IP protocol 113 from untrusted or unnecessary sources.
• Add monitoring for Windows kernel crashes, bugchecks, and Windows Error Reporting events involving RMCAST or network-driver faults.
• Treat unexpected RMCAST-related crashes as potential exploitation attempts and preserve memory dumps, event logs, firewall logs, and packet captures for investigation.
• Track Microsoft advisory updates for exact fixed builds, KBs, known issues, and any change in exploitability assessment.
• Reassess urgency if exploit code appears, EPSS rises, threat actors begin exploitation, or the vulnerability is added to CISA KEV.