CVE-2026-62816 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

CVE-2026-62816 is a critical remote code execution vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST). A heap-based buffer overflow involving an integer overflow or wraparound can be triggered by an unauthenticated attacker sending a specially crafted packet to an affected service over an adjacent network. Successful exploitation could allow attacker-controlled code to execute on the target system.

CVSS Score: 8.8.

SEVERITY: Critical.

THREAT:
An attacker with adjacent network access could target an affected RMCAST service using a specially crafted packet. Attack complexity is low, privileges are not required, and no user interaction is needed. Successful exploitation can have high confidentiality, integrity, and availability impact.

EXPLOITS:
This vulnerability was not publicly disclosed and was not reported as exploited at publication. Exploit code maturity is listed as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow associated with an integer overflow or wraparound in the Windows Reliable Multicast Transport Driver (RMCAST). An unauthenticated attacker can send a specially crafted packet to an affected service over an adjacent network. Processing that packet can trigger the memory corruption condition and allow remote code execution on the target system. The attack requires low complexity, no privileges, and no user interaction, while successful exploitation can compromise confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations and supported architectures. Exploitation can occur by sending a specially crafted packet to an affected service from an adjacent network.

BUSINESS IMPACT:
Successful exploitation could allow unauthorized code execution and result in loss of confidentiality, unauthorized changes, or service disruption on affected systems. Because authentication and user interaction are not required, exposed affected services on reachable adjacent networks represent a significant organizational risk.

WORKAROUND:
No mitigations or workarounds are specified. An official fix is available, so affected systems should be updated with the applicable security update.

URGENCY:
This vulnerability is rated Critical and can enable remote code execution without privileges or user interaction. Although it was not reported as exploited or publicly disclosed and exploitation is assessed as Less Likely, its potential for high confidentiality, integrity, and availability impact makes timely deployment important.