CVE-2026-78450: RMCAST Driver Use-After-Free Vulnerability

CVE-2026-78450 Overview

CVE-2026-78450 is a use-after-free vulnerability [CWE-416] in the Windows Reliable Multicast Transport Driver (RMCAST). The flaw allows an unauthenticated remote attacker to execute arbitrary code over the network. RMCAST implements the Pragmatic General Multicast (PGM) protocol used for reliable multicast delivery in Windows environments.

Exploitation requires no privileges and no user interaction. The CVSS attack complexity is rated High, indicating the attacker must win a race or meet specific memory-state conditions to trigger the freed-object reuse. Successful exploitation compromises confidentiality, integrity, and availability of the target system.

Critical Impact
Unauthenticated remote code execution in a Windows kernel-mode driver, granting attackers the ability to run code with SYSTEM-level privileges on vulnerable hosts.

Affected Products

Microsoft Windows implementations of the Reliable Multicast Transport Driver (RMCAST / pgm.sys)
Refer to the Microsoft CVE-2026-78450 Update Guide for the authoritative list of affected builds
Systems with the Microsoft Message Queuing (MSMQ) or PGM multicast components enabled

Discovery Timeline

2026-09-08 - CVE-2026-78450 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-78450

Vulnerability Analysis

The vulnerability resides in the RMCAST driver, which handles PGM multicast traffic in the Windows networking stack. A use-after-free condition occurs when the driver references a memory object after it has been released. Attackers who can trigger this state may redirect execution flow to attacker-controlled data.

Because RMCAST executes in kernel mode, successful exploitation yields code execution at the highest privilege level on the host. The vulnerability is reachable over the network without authentication, allowing attackers on adjacent or routed networks to send crafted PGM packets to trigger the flaw. Attack complexity is elevated because the attacker must reliably reclaim the freed allocation before it is dereferenced.

Root Cause

The root cause is improper lifecycle management of a driver object within RMCAST. Object references are used after the underlying allocation has been freed, producing a dangling pointer condition classified as [CWE-416]. Detailed technical analysis has not been published beyond the vendor advisory.

Attack Vector

The attack vector is network-based. An attacker sends crafted PGM protocol traffic to a host that has the RMCAST driver active, then races the allocator to place controlled data into the freed slot. If the race succeeds, the driver dereferences attacker-controlled memory and transfers execution. No prior authentication or user interaction is required.

No public proof-of-concept code is available at this time. See the Microsoft CVE-2026-78450 Update Guide for vendor technical detail.

Detection Methods for CVE-2026-78450

Indicators of Compromise

Unexpected inbound PGM protocol traffic (IP protocol 113) to hosts that do not normally consume multicast
Kernel bugchecks or pgm.sys faults in the Windows Event Log correlated with external network activity
New or unexplained SYSTEM-level process creation following anomalous multicast traffic
Loading of RMCAST components on systems where MSMQ or multicast services were previously disabled

Detection Strategies

Inspect network telemetry for PGM traffic originating from untrusted network segments or reaching hosts outside multicast domains
Correlate driver crash events for pgm.sys with kernel-mode exception telemetry from endpoint agents
Hunt for post-exploitation behavior such as unexpected kernel module loads, credential access, or lateral movement following multicast traffic bursts

Monitoring Recommendations

Enable Windows Defender Firewall logging and alert on inbound IP protocol 113 traffic to endpoints
Baseline which hosts legitimately require RMCAST or MSMQ so anomalous exposure is quickly identifiable
Forward kernel event logs, driver load events, and network flow records to a centralized analytics platform for correlation

How to Mitigate CVE-2026-78450

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory to all affected Windows systems
Inventory hosts with the RMCAST driver or MSMQ role enabled and prioritize patching internet-exposed or DMZ systems first
Block inbound PGM protocol (IP protocol 113) at perimeter and internal segmentation boundaries where multicast is not required

Patch Information

Microsoft has published a fix through the standard security update channel. Consult the Microsoft CVE-2026-78450 Update Guide for build-specific KB article numbers and download links. Deploy through Windows Update, WSUS, Microsoft Endpoint Configuration Manager, or Intune according to your patching workflow.

Workarounds

Disable the MSMQ service on hosts that do not require message queuing, which removes the code path that loads RMCAST
Restrict PGM multicast traffic at the network layer using ACLs on routers, switches, and host firewalls
Apply host-based firewall rules to block IP protocol 113 on endpoints that must remain online before patching is complete