CVE-2026-69530 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

A critical use-after-free vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST) could allow an unauthenticated attacker to execute code remotely. Exploitation requires winning a race condition, which increases attack complexity, but a successful attack could have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.1.

SEVERITY: Critical.

THREAT: An attacker can target an affected RMCAST service over the network with a specially crafted packet. Successful exploitation could result in remote code execution on the target system. The attack requires no privileges and no user interaction, although successful exploitation depends on winning a race condition.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit Code Maturity is Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY: The vulnerability is caused by a use-after-free condition (CWE-416) in the Windows Reliable Multicast Transport Driver (RMCAST). An unauthenticated attacker could send a specially crafted packet to an affected service over the network and attempt to trigger a race condition. If successful, the attacker could execute code on the target system. The CVSS metrics identify high potential impact to confidentiality, integrity, and availability, with network-based access, no required privileges, and no required user interaction.

EXPLOITABILITY: Affected products are Windows 10 Version 1809 for 32-bit and x64-based systems; Windows Server 2019, 2022, and 2025, including their Server Core installations. Exploitation can occur remotely by sending a specially crafted packet to an affected service, but the attacker must successfully win a race condition.

BUSINESS IMPACT: Successful exploitation could give an unauthenticated remote attacker the ability to execute code on affected Windows systems. This creates significant risk to the confidentiality, integrity, and availability of business systems and data, particularly where affected services are reachable over a network.

WORKAROUND: No workaround or mitigation is identified. An official fix is available.

URGENCY: This vulnerability is rated Critical and enables network-based remote code execution without authentication or user interaction. Although exploitation is assessed as Less Likely and requires winning a race condition, affected systems should be prioritized for patch deployment because successful exploitation could have high confidentiality, integrity, and availability impacts.