External risk intelligence

Use After Free in Windows RMCAST Driver Allows Network Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-54995

The vulnerability affects the Reliable Multicast Transport Driver (RMCAST). RMCAST is designed for internal network communication and specialized multicast traffic, not for internet-facing services. Standard network perimeter configurations typically block or filter this type of traffic, making direct exposure to the public internet highly uncommon in standard Windows deployments.

Use After Free

Microsoft Windows 10 1607

before 10.0.14393.9339before 10.0.17763.9020before 10.0.19044.7548before 10.0.19045.7548before 10.0.26100.8875before 10.0.26200.8875before 10.0.28000.2525r2before 10.0.20348.5386b...

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a component of the Windows operating system that handles network data transmission. This flaw could allow an unauthorized attacker to execute arbitrary code over a network, potentially leading to a significant compromise of affected systems. The concern is primarily related to the potential exposure of this specific network transport driver.

A network flaw allows attackers to run unauthorized code.
It affects core Windows networking capabilities.
Confirm relevance and exposure for this critical network flaw.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network traffic. This could lead to the execution of arbitrary code on the affected system, potentially allowing the attacker to gain control.

Requires unauthenticated network access.
Triggered by sending malicious network data.
Allows unauthenticated code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability involves a "use after free" error within the Reliable Multicast Transport Driver (RMCAST). When this driver is active and receives specially crafted network packets, it can lead to code execution. This exploitation is possible remotely and does not require any privileges or user interaction, though it may require specific network conditions to be met.

System kernel code is at risk.
Exploitation may occur over a network.
Remote code execution is a realistic consequence.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Windows Reliable Multicast Transport Driver requires immediate attention. Infrastructure or platform teams are likely responsible for managing the affected Windows operating systems and their network configurations. The first actionable step is to identify all instances of the affected Windows versions within your environment, confirm their network reachability, and then determine the business criticality of each system before planning remediation efforts.

Confirm asset inventory and network exposure.
Identify accountable system or application owners.
Plan and execute necessary updates or mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Reliable Multicast Transport Driver (RMCAST)?

RMCAST is a Windows component used for managing efficient, one-to-many network data transmission. It is a specialized driver that handles multicast traffic, allowing a single data stream to be sent to multiple recipients simultaneously. It is integrated into various versions of Windows 10, Windows 11, and Windows Server, serving core networking functions for systems that rely on multicast communication protocols for data delivery.

What does the CVE-2026-54995 use-after-free weakness mean?

This vulnerability is a use-after-free, classified as CWE-416. It occurs when a program continues to use a memory location after that memory has been freed. In the context of the RMCAST driver, this error can be manipulated when the driver improperly handles specific data, potentially allowing an attacker to overwrite that memory. If successful, this can lead to unauthorized code execution, effectively letting an attacker run their own instructions on the system.

How is CVE-2026-54995 triggered?

An attacker triggers this flaw by sending specially crafted network packets to the RMCAST driver. Because the driver processes this traffic, the vulnerability can be exploited remotely over a network. It does not require the attacker to have user credentials or any prior access to the system. However, the driver must be active and reachable to process the malicious input; traffic that is blocked or not routed to the system will not trigger this vulnerability.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal assesses the risk as unlikely for most systems because RMCAST is intended for internal network communication rather than internet-facing services. Standard network perimeters typically filter or block the specific multicast traffic this driver uses. Therefore, unless your Windows configuration explicitly permits this specialized traffic from untrusted sources, direct exposure to the public internet is considered highly uncommon for this component.

What are the first steps to address this CVE?

Start by identifying all instances of the affected Windows versions within your environment. Once identified, evaluate their network configuration to confirm whether the RMCAST driver is reachable from untrusted network segments. Prioritize systems based on their business criticality and exposure. Your primary objective is to plan and apply the necessary security updates provided by the vendor to remediate the vulnerability in the underlying driver software.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54995

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.