CVE-2026-69530: RMCAST Use After Free Vulnerability

CVE-2026-69530 Overview

CVE-2026-69530 is a use-after-free vulnerability [CWE-416] in the Windows Reliable Multicast Transport Driver (RMCAST). The flaw allows an unauthenticated remote attacker to execute arbitrary code over a network. Exploitation targets the Pragmatic General Multicast (PGM) transport implemented by the rmcast.sys kernel driver.

Microsoft published the advisory on September 8, 2026. Successful exploitation grants attacker-controlled code execution in a kernel context, resulting in full compromise of the affected system.

Critical Impact
An unauthenticated network attacker can trigger a use-after-free in the RMCAST kernel driver to execute code remotely without user interaction.

Affected Products

Microsoft Windows (RMCAST driver, rmcast.sys)
Windows Server editions supporting PGM multicast
Systems with the Reliable Multicast Protocol feature enabled

Discovery Timeline

2026-09-08 - Microsoft publishes advisory for CVE-2026-69530
2026-09-08 - CVE-2026-69530 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-69530

Vulnerability Analysis

The vulnerability resides in the Reliable Multicast Transport Driver (RMCAST), which implements PGM-based reliable multicast delivery on Windows. The driver mishandles the lifetime of an internal object, freeing memory while a reference to it remains reachable through another code path. A subsequent operation dereferences the freed allocation, leading to attacker-influenced control flow in kernel mode.

Because RMCAST processes traffic received over the network, no local presence or authentication is required. The attack complexity is elevated because reliable exploitation depends on winning a memory-state race and shaping the kernel pool. When the conditions are met, the attacker gains arbitrary code execution with full system impact on confidentiality, integrity, and availability.

Root Cause

The root cause is a use-after-free condition [CWE-416] in the RMCAST driver. A code path releases an allocation representing multicast session state without invalidating outstanding pointers held elsewhere in the driver. Later access to the dangling pointer allows an attacker who controls the freed slab contents to redirect execution.

Attack Vector

Exploitation occurs over the network by sending crafted PGM packets to a host running the RMCAST service. The attacker orchestrates allocation and free operations within the driver to place controlled data into the freed region. See the Microsoft CVE-2026-69530 Advisory for vendor-specific technical details.

Detection Methods for CVE-2026-69530

Indicators of Compromise

Unexpected PGM (IP protocol 113) traffic to or from Windows hosts that do not use multicast applications
Crashes or bugchecks referencing rmcast.sys in MEMORY.DMP or WER reports
Anomalous kernel-mode process creation following inbound multicast traffic

Detection Strategies

Inspect network flows for unsolicited PGM packets targeting Windows systems, especially across subnet or VLAN boundaries
Correlate kernel driver crashes involving rmcast.sys with preceding network activity
Alert on new outbound connections initiated by kernel-adjacent processes shortly after multicast traffic

Monitoring Recommendations

Enable Windows Event Log forwarding for System channel events tied to driver faults
Capture NetFlow or packet metadata for IP protocol 113 at network egress and ingress points
Baseline expected multicast publishers and subscribers and alert on deviations

How to Mitigate CVE-2026-69530

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-69530 Advisory to all affected Windows systems
Inventory hosts with the Reliable Multicast Protocol feature enabled and prioritize patching internet-exposed or DMZ systems
Restrict PGM traffic (IP protocol 113) at perimeter and internal segmentation points until patching completes

Patch Information

Microsoft has released a security update addressing CVE-2026-69530. Refer to the Microsoft CVE-2026-69530 Advisory for the specific KB article, affected builds, and installation guidance.

Workarounds

Disable the Reliable Multicast Protocol feature on hosts that do not require PGM
Block inbound IP protocol 113 (PGM) at firewalls and host-based ACLs
Apply network segmentation to isolate systems that must run multicast workloads

bash

# Disable the Windows Reliable Multicast Protocol feature (PowerShell, elevated)
Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Multicast

# Block inbound PGM (IP protocol 113) with Windows Firewall
New-NetFirewallRule -DisplayName "Block PGM Inbound" -Direction Inbound -Protocol 113 -Action Block