CVE-2026-78449 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

CVE-2026-78449 is a critical use-after-free vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST). An unauthenticated attacker could send a specially crafted packet to an affected service over the network and potentially execute code on the target system. Exploitation is considered less likely because attack complexity is high and successful exploitation depends on multiple environmental and system factors.

CVSS SCORE: 8.1.

SEVERITY: Critical.

THREAT: The vulnerability creates a network-based remote code execution threat affecting multiple Windows client and server releases. A successful attack could have a high impact on confidentiality, integrity, and availability. No privileges or user interaction are required, although successful exploitation requires high attack complexity.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and the exploitation assessment is Exploitation Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY: The vulnerability is caused by a use-after-free weakness (CWE-416) in the Windows Reliable Multicast Transport Driver (RMCAST). An unauthenticated attacker could send a specially crafted packet to an affected service over the network and potentially trigger the memory-management flaw, resulting in remote code execution. The CVSS metrics indicate a network attack vector, no privileges required, no user interaction, unchanged scope, and high potential impact to confidentiality, integrity, and availability. Exploitation has high complexity and requires a deep understanding of the system; success can depend on system configuration, environment, and additional security measures.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2 and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including listed Server Core installations and supported architectures shown in the source. Exploitation could occur remotely by sending a specially crafted packet to an affected service.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution and severely affect the confidentiality, integrity, and availability of an affected Windows system. For organizations, compromise of exposed or reachable systems could lead to unauthorized activity, data exposure or modification, and service disruption.

WORKAROUND: No workaround or mitigation is identified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical and can potentially allow remote code execution across affected Windows clients and servers without authentication or user interaction. Although exploitation is assessed as less likely and no exploitation is reported, the high potential impact makes timely deployment of the official security update important.