CVE-2026-54982: Windows 10 1607 RMCAST RCE Vulnerability

CVE-2026-54982 Overview

CVE-2026-54982 is an integer underflow vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST), a kernel-mode component that implements the Pragmatic General Multicast (PGM) protocol. An unauthorized attacker on an adjacent network can trigger the wraparound condition to execute arbitrary code. The flaw affects all currently supported versions of Windows client and server operating systems, including Windows 11 26H1 and Windows Server 2025. Microsoft has released security updates through the Microsoft Security Response Center (MSRC).

Critical Impact
Successful exploitation grants arbitrary code execution in the context of the RMCAST kernel driver, resulting in full compromise of the affected host without user interaction or authentication.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - CVE-2026-54982 published to the National Vulnerability Database
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-54982

Vulnerability Analysis

The Reliable Multicast Transport Driver (rmcast.sys) implements the Pragmatic General Multicast (PGM) protocol on Windows. PGM adds reliability semantics over IP multicast, requiring the driver to parse length-encoded packet headers and negative acknowledgment (NAK) fields from network peers.

The vulnerability arises when the driver subtracts an attacker-controlled value from a length or offset field without first validating that the minuend is greater than or equal to the subtrahend. When the subtraction underflows an unsigned integer, the result wraps to a very large value. That value is then used as a size or index for a subsequent memory operation, producing an out-of-bounds write inside kernel memory. Successful shaping of the corrupted allocation grants arbitrary code execution at kernel privilege.

Root Cause

The root cause is classified as [CWE-191] Integer Underflow (Wrap or Wraparound). RMCAST performs arithmetic on unsigned length fields extracted from PGM packets before bounds are enforced. When a crafted packet supplies a small header length or an oversized offset, the resulting subtraction wraps and defeats subsequent length checks.

Attack Vector

Exploitation requires network adjacency, meaning the attacker must be able to deliver PGM multicast traffic to the target segment. This condition is satisfied on shared local networks, guest VLANs, or through a compromised host on the same broadcast domain. The attack requires no authentication and no user interaction. No public proof-of-concept is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code has been published. Technical details are described in the Microsoft Security Update for CVE-2026-54982.

Detection Methods for CVE-2026-54982

Indicators of Compromise

Unexpected PGM traffic (IP protocol number 113) on network segments where multicast messaging is not sanctioned.
Kernel bugchecks or rmcast.sys stack traces in Windows crash dumps that correlate with inbound multicast activity.
New kernel-mode threads or unsigned drivers loaded shortly after receipt of PGM multicast packets.

Detection Strategies

Inspect network telemetry for PGM (IP protocol 113) sessions from unauthorized sources and alert on any use outside of documented applications such as MSMQ.
Correlate Windows Error Reporting entries referencing rmcast.sys with concurrent network capture data to identify probable exploitation attempts.
Deploy EDR rules that flag process creation, driver loads, or LSASS access originating from the System process immediately following PGM traffic.

Monitoring Recommendations

Enable audit logging for driver installation events (Event ID 7045) and kernel-mode signature failures on all Windows endpoints.
Baseline multicast group membership and alert on hosts that unexpectedly join reliable multicast groups.
Forward endpoint and network telemetry to a centralized analytics platform for cross-source correlation of adjacent-network anomalies.

How to Mitigate CVE-2026-54982

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-54982 to all affected Windows client and server hosts.
Prioritize patching for systems on shared network segments, guest networks, and datacenter VLANs where adjacent attackers are more likely to reside.
Audit whether any application on the host actually requires PGM multicast and disable the Message Queuing (MSMQ) feature where it is not in use.

Patch Information

Microsoft published fixes for CVE-2026-54982 through the standard Windows Update channel. Refer to the Microsoft Security Update for CVE-2026-54982 for the specific KB article and build numbers that apply to each Windows version. The update corrects the length validation logic inside rmcast.sys before the arithmetic operation is performed.

Workarounds

Block IP protocol 113 (PGM) at network boundaries and on host firewalls where reliable multicast is not required.
Remove the Message Queuing (MSMQ) Windows feature on systems that do not use it, which unloads rmcast.sys from the kernel.
Segment untrusted hosts and guest networks so that adjacent attackers cannot reach servers that must retain PGM functionality.

bash

# Disable Message Queuing feature to unload the vulnerable RMCAST driver
DISM /Online /Disable-Feature /FeatureName:MSMQ-Container /Remove

# Block inbound PGM (IP protocol 113) at the Windows firewall
netsh advfirewall firewall add rule name="Block PGM Inbound" ^
  dir=in action=block protocol=113