CVE-2026-78449

CVE-2026-78449 is a use-after-free flaw (CWE-416) in Microsoft's Reliable Multicast Transport Driver (RMCAST, rmcast.sys), the Windows driver that implements the PGM reliable multicast transport used by features such as Message Queuing (MSMQ). An unauthorized remote attacker could trigger it by sending crafted network traffic that causes the driver to access freed memory, although the high attack complexity (CVSS AC:H) means exploitation depends on favorable timing or state conditions. Successful exploitation would allow arbitrary code execution in the context of the driver, with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 8.1, High). Only systems running the affected RMCAST driver - typically Windows hosts where the optional Reliable Multicast Protocol/MSMQ multicast capability is installed, enabled, and network-reachable - are exposed; the specific affected Windows versions are enumerated in Microsoft's September 2026 Patch Tuesday release. As of now there is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns it a low 0.5% probability of exploitation within 30 days, so exploitation has not yet been observed.

What to do: Apply Microsoft's September 2026 Patch Tuesday updates promptly, prioritizing any servers or workstations with Message Queuing (MSMQ) or the optional Reliable Multicast Protocol (PGM) feature enabled, and confirm the updated rmcast.sys driver is loaded after reboot. Until patched, consider disabling the Reliable Multicast Protocol feature or restricting network access to trusted sources on affected hosts. Check Microsoft's advisory for the definitive list of affected Windows versions and any exploitability updates.