CVE-2026-54995: An unauthenticated attacker can send crafted PGM multicast packets to crash Windows at the kernel level — or potentially achieve remote code execution. The bug: an integer underflow in rmcast.sys's FEC parity counter wraps a byte from 0 to 255, causing out-of-bounds writes into kernel pool memory during FEC decoding. Affects every supported Windows version (client + server). Microsoft patched it in July 2026 with a validation check before FEC decode — but left the underflow itself intact. CVSS 8.1 (Microsoft) · Our CVSS 4.0: 7.2 — the attack requires a PGM receiver app to be running (uncommon outside MSMQ/multicast deployments). Full root cause analysis, annotated disassembly, patch diff, PoC, and detection rules: https://aretiq.ai/research/15/
Post summary
The post details the CVE‑2026‑54995 kernel‑level integer underflow, confirms Microsoft’s July 2026 patch, provides a PoC link, but does not report active exploitation or false positives.
