A heap-based buffer overflow in the Windows Reliable Multicast Transport Driver enables unauthenticated remote code execution for attackers on an adjacent network.

This vulnerability involves a heap-based buffer overflow and integer overflow (CWE-122, CWE-190) within the RMCAST driver. The attack vector is adjacent, meaning the attacker must be on the same local network segment, but no authentication is required.

With a CVSS score of 8.8, this vulnerability poses a severe threat to local network security. An attacker could gain control over systems on the same subnet, leading to potential data theft or the deployment of malware, even without prior system access.

Immediate Action: Apply the latest security updates from Microsoft, which address the vulnerabilities in the RMCAST driver.

Proactive Monitoring: Review system and network logs for unusual multicast traffic or unexpected driver-level errors that might suggest an exploit attempt.

Compensating Controls: Implement network segmentation to isolate critical assets and disable the RMCAST service on systems where it is not required for business operations.

Public Exploit Available: Unknown

This vulnerability should be addressed with urgency, particularly on systems residing on shared or less-trusted network segments. Patching remains the most effective defense against this driver-level flaw.