CVE-2026-85943: RMCAST Driver Race Condition Vulnerability

CVE-2026-85943 Overview

CVE-2026-85943 is a time-of-check time-of-use (TOCTOU) race condition in the Windows Reliable Multicast Transport Driver (RMCAST). An authorized local attacker can exploit the race window to elevate privileges on the affected system. Microsoft published the advisory through its Security Update Guide on October 13, 2026.

The flaw is tracked under [CWE-122] (Heap-based Buffer Overflow) as the downstream memory corruption primitive triggered by the race. Exploitation requires local access and low privileges, but no user interaction. Successful exploitation yields high impact to confidentiality, integrity, and availability of the host.

Critical Impact
A local, authenticated attacker who wins the race condition in RMCAST can corrupt kernel heap memory and escalate to SYSTEM privileges on affected Windows systems.

Affected Products

Microsoft Windows (Reliable Multicast Transport Driver / RMCAST component)
Refer to the Microsoft Security Update Guide for the authoritative list of affected builds
Specific product and version mapping was not published in the NVD record at the time of writing

Discovery Timeline

2026-10-13 - CVE-2026-85943 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85943

Vulnerability Analysis

The vulnerability resides in the Reliable Multicast Transport Driver (RMCAST), the kernel-mode component implementing Microsoft's Pragmatic General Multicast (PGM) protocol stack. RMCAST runs in kernel context and processes buffers supplied by user-mode callers through the socket interface.

A TOCTOU race condition exists between the validation of a buffer or state variable and its subsequent use. An attacker running concurrent threads can modify the shared data after the driver validates it but before the driver consumes it. The mismatch between checked and used values leads to a heap-based buffer overflow in the kernel pool, as reflected by the [CWE-122] mapping.

Because the corruption occurs in kernel memory, successful exploitation grants full control over the kernel object layout, enabling privilege escalation to SYSTEM. The attack complexity is high because the attacker must reliably win the race window, which varies with CPU scheduling and system load.

Root Cause

The root cause is non-atomic access to attacker-influenced data in the RMCAST driver. The driver reads or validates a value, releases implicit synchronization, and then re-reads the same value when performing a sensitive operation such as a length-bounded copy. A second thread modifies the value between the two accesses, invalidating the earlier bounds check.

Attack Vector

Exploitation requires local code execution with low privileges on the target host. The attacker opens an RMCAST/PGM socket and issues I/O control requests while a second thread continuously mutates the shared buffer. By repeatedly racing the driver, the attacker triggers a heap overflow in paged or non-paged pool and overwrites kernel structures to pivot into SYSTEM-level code execution.

No verified public exploit code is available at this time. See the Microsoft Security Update Guide for Microsoft's technical description.

Detection Methods for CVE-2026-85943

Indicators of Compromise

Unexpected loading or heavy I/O activity against the rmcast.sys driver from non-administrative user sessions
Kernel bugchecks (BSOD) referencing rmcast.sys or pool corruption, which may indicate failed exploitation attempts
New processes spawning with SYSTEM integrity from a parent process running as a standard user

Detection Strategies

Monitor for processes that open PGM sockets (IPPROTO_RM) outside of known multicast applications
Alert on token manipulation and parent-child integrity level mismatches indicative of local privilege escalation
Correlate driver crash events (Event ID 1001, BugCheck) with user-mode process activity to surface race-condition exploitation attempts

Monitoring Recommendations

Enable kernel pool tagging and Driver Verifier on high-value hosts during triage to detect pool corruption in rmcast.sys
Forward Windows Event Logs, Sysmon process creation events, and EDR telemetry to a centralized data lake for cross-host correlation
Baseline normal usage of multicast/PGM functionality so that anomalous socket activity stands out

How to Mitigate CVE-2026-85943

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as it is tested in your environment
Inventory hosts that have the Reliable Multicast Transport Driver installed and prioritize servers and multi-user systems
Restrict interactive and remote logon rights on affected systems to reduce the pool of users who can trigger the local attack

Patch Information

Microsoft addresses CVE-2026-85943 through its monthly security update channel. Consult the Microsoft Security Update Guide entry for CVE-2026-85943 for the specific KB article, build numbers, and supersedence information for each affected Windows release.

Workarounds

Disable or remove the Reliable Multicast Transport Driver on systems that do not require PGM multicast functionality
Block creation of PGM sockets through application control or Windows Defender Application Control (WDAC) policies where feasible
Enforce least privilege and remove local administrator rights to limit which accounts can stage the race condition

bash

# Query whether the RMCAST driver is present and running
sc.exe query RMCAST

# Stop and disable the driver on hosts that do not need PGM multicast
sc.exe stop RMCAST
sc.exe config RMCAST start= disabled