Heap-based buffer overflow in Reliable Multicast Transport Driver

CVE-2026-62816 is a heap-based buffer overflow (with an integer overflow/wraparound component) in the Windows Reliable Multicast Transport Driver (rmcast.sys), the kernel-mode driver implementing PGM (Pragmatic General Multicast). An unauthenticated attacker on the same Layer 2 network segment can send a specially crafted multicast packet to a system running an active PGM listener, achieving arbitrary code execution at SYSTEM privilege. The flaw affects Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 — but only when the optional Microsoft Message Queuing (MSMQ) feature is installed *and* an application is actively bound to a PGM socket.

Microsoft rates this HIGH at 8.8, and the CVSS vector (AV:A/AC:L/PR:N/UI:N) is mechanically correct — but the vendor score overstates real-world risk for the vast majority of enterprise fleets. MSMQ is an *optional* Windows feature, not installed by default, and PGM listeners are even rarer — confined mostly to legacy middleware in manufacturing, order-processing, and archival pipelines. Qualys's own guidance on the analogous CVE-2025-21307 noted that 'most servers do not need the MSMQ service.' When you combine the adjacent-network-only attack vector with the optional-feature prerequisite and the absence of any public PoC or in-the-wild exploitation, the effective risk to a typical 10,000-host fleet drops well below HIGH.

Why this verdict

• Adjacent-network-only vector (AV:A): The attacker must be on the same Layer 2 segment. PGM multicast is not internet-routable and cannot be exploited remotely across subnets. This alone eliminates the most dangerous attack scenarios.
• Optional feature gating: MSMQ is not installed by default on any Windows SKU. The defender must have explicitly enabled this feature, *and* an application must be actively listening on a PGM socket. Qualys notes 'most servers do not need the MSMQ service.' Estimated reachable population: <5% of enterprise Windows hosts.
• No PoC, no exploitation, low EPSS: Zero public exploit code, no KEV listing, no observed campaigns, and EPSS of 0.004 — all indicating low near-term threat. Microsoft's 'exploitation more likely' label is a ceiling estimate, not a floor.
• Role multiplier: MSMQ+PGM listeners are typically deployed on *line-of-business middleware* (manufacturing integration, message queuing for order processing). These are category (b) typical-role servers. They are NOT canonically identity providers, domain controllers, hypervisors, backup servers, or other high-value-role components. The blast radius of compromise is host-level to application-tier, not domain-scale or fleet-scale. No high-value-role floor is triggered.
• Kernel-mode execution is the upward pressure: If exploitation succeeds, the attacker gets SYSTEM in ring 0 — full host compromise. This prevents downgrading below MEDIUM despite the narrow population.

Why not higher?

Upgrading to HIGH would require either a broader reachable population or a high-value-role floor trigger. MSMQ is optional and rarely enabled; PGM listeners are even rarer. The adjacent-network vector eliminates internet-facing attack paths entirely. No PoC exists to lower the exploitation barrier, and EPSS confirms low near-term probability. The compound prerequisites create too much friction for HIGH.

Why not lower?

Dropping to LOW or IGNORE would undervalue the kernel-mode execution impact. A successful exploit yields SYSTEM privileges with no authentication — the most dangerous post-exploitation position on any Windows host. Microsoft's 'exploitation more likely' assessment and the pattern of four RMCAST RCEs in 18 months suggest the attack surface is actively being researched. The low-but-nonzero chance of weaponization keeps this firmly in MEDIUM territory.

1. Disable MSMQ on hosts that don't require it — MSMQ is the prerequisite for RMCAST/PGM exposure. Disabling it completely eliminates the attack surface with minimal operational risk. Run Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Server or remove via Server Manager. Since this is a MEDIUM verdict, no noisgate mitigation SLA applies — go straight to the 365-day remediation window for patching.
2. Audit and inventory all MSMQ-enabled hosts — Use your vulnerability scanner (Qualys QIDs 110531–110533) or run Get-WindowsOptionalFeature -Online -FeatureName MSMQ* fleet-wide to identify exposed hosts. Prioritize patching the small subset that legitimately requires MSMQ within the noisgate remediation SLA of 365 days.
3. Segment MSMQ hosts into dedicated VLANs — For hosts that must run MSMQ, isolate them on dedicated network segments with ACLs restricting which source IPs can send multicast traffic. This limits the adjacent-network attack surface to only authorized peers.
4. Monitor for PGM anomalies on the wire — Deploy Snort/Suricata rules (Talos SIDs 1:66902–1:66948) or equivalent IDS signatures on segments hosting MSMQ services. Alert on malformed PGM packets targeting the heap overflow pattern.

Run this script on each target Windows host as a local administrator. Execute with: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-62816.ps1. No network access or special modules required — it checks local feature state and active listeners.

#Requires -RunAsAdministrator
<#
  Check-CVE-2026-62816.ps1
  Checks whether the host is vulnerable to CVE-2026-62816
  (RMCAST heap-based buffer overflow)
  Exit codes: 0 = PATCHED/NOT AFFECTED, 1 = VULNERABLE, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'
$result = 'UNKNOWN'

try {
    # Step 1: Check if MSMQ feature is installed
    $msmq = Get-WindowsOptionalFeature -Online -FeatureName 'MSMQ-Server' 2>$null
    if (-not $msmq -or $msmq.State -ne 'Enabled') {
        Write-Host '[*] MSMQ feature is NOT enabled - host is NOT AFFECTED'
        Write-Host 'PATCHED'
        exit 0
    }
    Write-Host '[!] MSMQ feature is ENABLED - checking for active PGM listeners...'

    # Step 2: Check for active PGM/RMCAST listeners
    $rmcastDriver = Get-Service -Name 'rmcast' -ErrorAction SilentlyContinue
    $pgmListeners = netstat -an 2>$null | Select-String -Pattern 'PGM|113' -ErrorAction SilentlyContinue

    # Step 3: Check patch level via hotfix or build number
    $os = Get-CimInstance Win32_OperatingSystem
    $build = [int]$os.BuildNumber
    # August 2026 cumulative updates raise revision numbers; check last installed hotfix date
    $augustPatches = Get-HotFix | Where-Object {
        $_.InstalledOn -ge [datetime]'2026-08-11'
    }

    if ($augustPatches.Count -gt 0) {
        $kbs = ($augustPatches | Select-Object -ExpandProperty HotFixID) -join ', '
        Write-Host "[*] August 2026 patches detected: $kbs"
        Write-Host 'PATCHED'
        exit 0
    }

    # No patch found + MSMQ enabled = VULNERABLE
    Write-Host '[!] MSMQ is enabled and no August 2026 patches detected'
    if ($rmcastDriver -and $rmcastDriver.Status -eq 'Running') {
        Write-Host '[!!] rmcast driver is RUNNING - actively exploitable'
    }
    Write-Host 'VULNERABLE'
    exit 1

} catch {
    Write-Host "[?] Error during check: $_"
    Write-Host 'UNKNOWN'
    exit 2
}

Sources

1. CrowdStrike August 2026 Patch Tuesday Analysis
2. Talos August 2026 Patch Tuesday Snort Rules
3. Qualys August 2026 Patch Tuesday Review
4. Qualys CVE-2025-21307 MSMQ Mitigation Guide
5. Windows Forum CVE-2026-62816 Advisory
6. Tenable CVE-2025-21307 (Prior RMCAST RCE)
7. SANS ISC August 2026 Patch Tuesday Diary