CVE-2026-54995

This vulnerability is in a Windows networking component (RMCAST). An attacker on the network may be able to trick Windows into using freed memory, and that can lead to running attacker code on your PC or server. Think of it like a “freed” object still being used—if someone times it right, they can take control instead of the system safely ignoring it.

This matters if you use or manage Windows 10, Windows 11, or the specified Windows Server editions listed for this CVE. The weakness is reachable over the network and does not require a login or any user action.

Because the findings don’t confirm whether it’s reachable from the internet by default, treat it as a risk anywhere the vulnerable networking component can receive attacker-controlled network traffic—especially on machines exposed to untrusted networks.

This is a RED issue because it’s remote code execution over the network with no authentication or user interaction required. Even though the findings don’t show clear, dated public exploitation or a known public exploit, the impact is severe enough that you should prioritize patching.

Apply the vendor fixes promptly across all affected systems, starting with machines most exposed to untrusted networks.

1. Confirm affected systems (inventory)

   • Build a list of all endpoints and servers running: Windows 10, Windows 11, and the specified Windows Server versions (2012, 2012 R2, 2016, 2019, 2022, 2025).

2. Verify whether the device is already patched (per OS branch)

   • Check the installed Windows update level on each machine and compare to the fixed versions below:
     • Windows 10: fixed in 10.0.14393.9339, 10.0.17763.9020, 10.0.19044.7548, 10.0.19045.7548
     • Windows 11: fixed in 10.0.26100.8875, 10.0.26200.8875, 10.0.28000.2525
     • Windows Server 2012: fixed in 6.2.9200.26226
     • Windows Server 2012 R2: fixed in 6.3.9600.23291
     • Windows Server 2016: fixed in 10.0.14393.9339
     • Windows Server 2019: fixed in 10.0.17763.9020
     • Windows Server 2022: fixed in 10.0.20348.5386

3. Apply the fix

   • Install the Microsoft update for CVE-2026-54995 on each affected machine.
   • Use the Microsoft update guide entry for the exact package(s) for your OS and update channel:
     • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54995

4. If patching is delayed (temporary risk reduction)

   • Reduce exposure by limiting which networks can reach these systems (for example, ensure they are not broadly reachable from untrusted networks).
   • Keep the limitation in place only until patch installation is completed, since the vulnerability is remote and does not require a login.

5. After installation

   • Re-check the OS build/version numbers against the fixed versions above.
   • Confirm machines are rebooted if your update process requires it.

6. Monitor

   • Watch for unusual network behavior around systems that have not yet been updated.
   • Prioritize remediation for any systems that are still behind on updates.

Severity is HIGH (CVSS 8.1) with remote attack characteristics. The underlying weakness is CWE-416 (use-after-free) in the Windows Reliable Multicast Transport Driver (RMCAST). The findings state: remote code execution via network, no authentication required, and no user interaction required.

KEV: not listed in CISA KEV. Exploit status from findings: no public exploit code on record and no clear dated press claim of exploitation; incidents of exploitation in the wild were not identified in the provided findings. Patch status: Microsoft has fixed versions available for multiple Windows 10/11 and Windows Server branches (listed in the patch section). “Use-after-free” implies memory is incorrectly reused after being freed, which can allow an attacker-controlled sequence to redirect execution flow, leading to arbitrary code execution.