CVE-2026-78450 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

A use-after-free vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST) could allow an unauthorized remote attacker to execute code on an affected Windows system. Exploitation requires sending a specially crafted packet to an affected service and successfully winning a race condition. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 8.1.

SEVERITY: Critical.

THREAT: An unauthenticated attacker could target an affected RMCAST service over the network with a specially crafted packet. Successful exploitation could result in remote code execution with high impact to confidentiality, integrity, and availability. Attack complexity is high because exploitation requires winning a race condition.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept (PoC) exploit code.

TECHNICAL SUMMARY: CVE-2026-78450 is a use-after-free vulnerability (CWE-416) in the Windows Reliable Multicast Transport Driver (RMCAST). An unauthenticated attacker can send a specially crafted network packet to an affected service and attempt to trigger the memory-management flaw. Successful exploitation requires winning a race condition, resulting in high attack complexity. If successful, the vulnerability allows code execution on the target system and can have high confidentiality, integrity, and availability impacts.

EXPLOITABILITY: Affected products are Windows 10 Version 1809 for 32-bit and x64-based systems, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including the listed Server Core installations. Exploitation is assessed as less likely and requires a specially crafted network packet and successful race condition. No privileges or user interaction are required.

BUSINESS IMPACT: Successful exploitation could enable unauthorized remote code execution, potentially compromising sensitive information, system integrity, and service availability. For organizations running affected Windows systems, a successful attack could lead to system compromise and operational disruption.

WORKAROUND: No workaround or mitigation is identified. An official fix is available.

URGENCY: This vulnerability is rated Critical and can allow unauthenticated remote code execution without user interaction. Although exploitation is assessed as less likely and no exploitation is currently identified, affected systems should be prioritized for deployment of the official fix because successful exploitation could have high confidentiality, integrity, and availability impacts.