Heap based buffer overflow in the Reliable Multicast Transport Driver (RMCAST) permits an unauthorized attacker to run arbitrary code when the driver handles network traffic from an adjacent network. The flaw is a classic out‑of‑bounds write that can corrupt the heap, leading to full compromise of the system where RMCAST is loaded. Because the driver operates in kernel mode, the attacker can gain system privileges and execute any code with the rights of the operating system.

Microsoft Windows 10 builds 1607, 1809, 21H2, 22H2, Windows 11 builds 23H2, 24H2, 25H2, 26H1, and Microsoft Windows Server releases 2012, 2012 R2, 2016, 2019, 2022 and 2025. All architectures supported by these builds are affected as documented by Microsoft.

The CVSS score of 7.5 indicates high severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, implying that a public exploit has not yet been observed. The likely attack vector is over an adjacent network that can reach the RMCAST service, so it requires network connectivity to the target. While the exact conditions for exploitation are not detailed, a heap corruption in a kernel driver can be highly dangerous if an attacker controls the input data that the driver processes.