CVE-2026-54995 is a high severity use-after-free flaw (CVSS 8.1) in the Windows Reliable Multicast Transport Driver (RMCAST). An unauthenticated attacker could execute code over a network. The record lists Windows 10, Windows 11 and Windows Server 2012 builds. Use the Microsoft update guide to find the update for your build.
What's affected
- Windows 10 versions 1607, 1809, 21H2 and 22H2, Windows 11 versions 24H2, 25H2 and 26H1, and Windows Server 2012, per the record.
- Fixed builds: not stated in the record. The Microsoft Security Response Center entry lists the update for each product and build.
- The record may list further Windows products than those named here, so read the full product table in the update guide.
How to check if you're exposed
Check the Windows build on each machine.
winver
Get-ComputerInfo | Select-Object OsName, OsVersion, WindowsVersion
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
Compare the result with the KB number listed for your build in the Microsoft update guide. Use your patch management tool to report machines missing that update across the fleet.
What to do now
- Open the Microsoft update guide entry for CVE-2026-54995 and note the KB for each Windows build you run.
- Deploy the update through your normal patch channel, starting with servers and internet facing systems.
- Restrict network exposure of hosts that cannot be patched at once.
- Confirm the update is installed with Get-HotFix or your management console.
- Plan to retire older systems such as Windows Server 2012 that are out of regular support, or check how Microsoft covers them for this CVE.
Why it matters
The class is CWE-416, use after free. The program frees a piece of memory and then keeps using it, so attacker influenced data can end up where the program expects its own. That is a classic route to code execution in kernel mode drivers.
The vector sets attack complexity to high, which is why the score is 8.1 and not higher. The record does not mark the CVE as exploited in the wild and gives no detail on how the flaw is reached, so this post does not guess. Network facing drivers on endpoints and servers should be patched on the normal schedule or faster.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
How do I know if my machines use the driver?
The record does not say. Check the Microsoft update guide for guidance, and patch regardless.
Sources
Last reviewed: 19 October 2026.
