Microsoft Windows RMCAST driver: Denial of service via null pointer dereference
Summary
The Reliable Multicast Transport Driver (RMCAST) in multiple Windows 10, Windows 11 and Windows Server versions contains a null pointer dereference (CWE-476). An unauthenticated attacker on the network can trigger it to crash the system or cause a service outage. The attack complexity is high, and the impact is limited to availability. Systems are only exposed if the driver is loaded and reachable over the network, which is typically the case when MSMQ multicast or PGM is in use.
Affected
- Windows 10 Version 1607 (builds before 10.0.14393.9688)
- Windows 10 Version 1809 (builds before 10.0.17763.9487)
- Windows 10 Version 21H2 (builds before 10.0.19044.7846)
- Windows 10 Version 22H2 (builds before 10.0.19045.7846)
- Windows 11 Version 23H2 (builds before 10.0.22631.7711)
- Windows 11 Version 24H2 (builds before 10.0.26100.9974)
- Windows 11 Version 25H2 (builds before 10.0.26200.9974)
- Windows 11 Version 26H1 (builds before 10.0.28000.3501)
- Windows 11 Version 26H2 (builds before 10.0.26300.9974)
- Windows Server 2016 and Server Core (builds before 10.0.14393.9688)
- Windows Server 2019 and Server Core (builds before 10.0.17763.9487)
- Windows Server 2022 (builds before 10.0.20348.5870)
- Source: CVE record; the MSRC advisory could not be retrieved, so verify the list there.
Fixed in
- Install the cumulative update for each product that brings the build to the first fixed version listed under Affected.
- KB article numbers: Unknown.
Workaround
Unknown.
- Third-party sources recommend disabling the Reliable Multicast feature (MSMQ-Multicast) where it is not needed and blocking PGM (IP protocol 113) at the firewall. These measures are not verified for this CVE.
Exploitation
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- Rapid7 rates exploitation as less likely and reports no public disclosure.
- No public proof of concept or exploitation report found. No CISA KEV entry found in the searches performed.
Our recommendation
- Inventory hosts running the affected Windows versions, and identify systems that use MSMQ or PGM.
- Apply the cumulative update that matches the fixed build from the Microsoft advisory.
- Where MSMQ multicast is not used, disable it and block PGM at the network perimeter.
- Monitor affected hosts for unexpected crashes or bugchecks.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Denial of service – Reliable Multicast Transport Driver (RMCAST)
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-116697 msrc.microsoft.com
- CVE Program record CVE-2026-116697 www.cve.org
- NVD entry CVE-2026-116697 nvd.nist.gov
- Strix CVE-2026-116697 www.strix.ai
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:18.
Original description (NVD)
Null pointer dereference in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to deny service over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.