CVE-2026-54995: Windows 10 1607 Use-After-Free Flaw

CVE-2026-54995 Overview

CVE-2026-54995 is a use-after-free vulnerability [CWE-416] in the Microsoft Windows Reliable Multicast Transport Driver (RMCAST), also known as pgm.sys. The flaw allows an unauthenticated attacker to execute arbitrary code over a network by sending crafted Pragmatic General Multicast (PGM) traffic to a vulnerable host. Microsoft rates this issue as Critical with a CVSS 3.1 base score of 9.8. The vulnerability affects a wide range of Windows client and server releases, including Windows 10, Windows 11, and Windows Server 2012 through Windows Server 2025.

Critical Impact
Unauthenticated remote code execution in a kernel-mode network driver, enabling full system compromise without user interaction.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - CVE-2026-54995 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-54995

Vulnerability Analysis

The Reliable Multicast Transport Driver implements the PGM protocol, a reliable multicast transport used by applications built on the Microsoft Message Queuing (MSMQ) stack and other multicast consumers. RMCAST runs in kernel mode as pgm.sys and processes multicast datagrams received from the network.

The vulnerability is a use-after-free condition [CWE-416] in RMCAST's handling of PGM protocol state. An attacker who sends a specially crafted sequence of multicast packets can cause the driver to reference a freed object, corrupting kernel memory. Successful exploitation yields code execution in the kernel context, giving the attacker SYSTEM-level control of the target.

Because the attack vector is Network, complexity is Low, and no privileges or user interaction are required, any Windows host with RMCAST reachable from the attacker is at risk.

Root Cause

The defect stems from incorrect object lifetime management inside RMCAST. A code path frees a heap-allocated structure while another path retains and later dereferences a pointer to that memory. Attackers can influence allocations to place controlled data in the freed region, converting the dangling pointer into an arbitrary read/write or control-flow hijack primitive in kernel space.

Attack Vector

Exploitation requires the attacker to reach an RMCAST-enabled endpoint. In most default deployments RMCAST is not exposed to the internet, but MSMQ-dependent environments and internal networks that permit PGM traffic (typically over IP protocol 113 and UDP/TCP port 2103) are directly reachable. An attacker on the same broadcast domain, or one that can route PGM traffic to the target, can trigger the vulnerable code path without authentication.

No public proof-of-concept code has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing. The EPSS score is 0.572%.

Detection Methods for CVE-2026-54995

Indicators of Compromise

Unexpected PGM multicast traffic (IP protocol 113) directed to Windows hosts that do not run MSMQ or multicast applications.
Bugchecks, crashes, or unexpected reloads of pgm.sys recorded in the System event log.
Kernel memory pool corruption alerts or unexpected SYSTEM-context child processes spawned shortly after inbound multicast traffic.

Detection Strategies

Monitor endpoints for loading of pgm.sys on systems where MSMQ or PGM is not required, and flag anomalous kernel driver behavior.
Correlate inbound PGM/multicast traffic with post-event process creation, driver load, and privilege change events on the receiving host.
Apply behavioral analytics to identify kernel exploitation patterns such as token manipulation or SYSTEM-context shell activity following network events.

Monitoring Recommendations

Enable network telemetry for IP protocol 113 and TCP/UDP port 2103, alerting on traffic to hosts that do not require RMCAST.
Ingest Windows kernel and driver crash telemetry into a centralized analytics platform and alert on repeated pgm.sys faults.
Track patch state for the July 2026 Microsoft security update across all Windows client and server assets.

How to Mitigate CVE-2026-54995

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-54995 advisory to all affected Windows client and server SKUs.
Inventory hosts that have the Message Queuing (MSMQ) role or feature installed, as these systems load RMCAST by default and should be patched first.
Block inbound PGM traffic (IP protocol 113 and TCP/UDP port 2103) at perimeter and internal segmentation firewalls where multicast is not required.

Patch Information

Microsoft has released security updates addressing CVE-2026-54995 for all supported Windows versions listed above. Refer to the Microsoft Security Update CVE-2026-54995 advisory for the corresponding KB article and package identifiers for each Windows build.

Workarounds

Uninstall or disable the Message Queuing (MSMQ) Windows feature on systems that do not require it, which removes the primary RMCAST attack surface.
Restrict PGM multicast traffic on host-based and network firewalls to trusted management VLANs only.
Apply network segmentation to isolate legacy Windows Server 2012 and 2016 systems until patching is complete.

bash

# Example: block PGM traffic on Windows using netsh advfirewall
netsh advfirewall firewall add rule name="Block PGM Inbound (CVE-2026-54995)" ^
  dir=in action=block protocol=113
netsh advfirewall firewall add rule name="Block PGM Port 2103 TCP" ^
  dir=in action=block protocol=TCP localport=2103
netsh advfirewall firewall add rule name="Block PGM Port 2103 UDP" ^
  dir=in action=block protocol=UDP localport=2103