Loading vulnerability…
Remote Code Execution in Windows Reliable Multicast Transport Driver (RMCAST)
CVE-2024-38140 is a remote code execution vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST). The flaw is described as a use-after-free condition in the RMCAST component. A remote, unauthenticated attacker can trigger the vulnerability by sending crafted network traffic to a vulnerable system using Pragmatic General Multicast (PGM). Exploitation is only possible when the PGM feature is enabled and an application is listening on a PGM port. Successful exploitation can result in arbitrary code execution on the target system.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows remote, unauthenticated code execution on the affected Windows system. Because the flaw is reachable over the network under the required conditions, it can permit full compromise of the targeted host in the security context of the affected component, enabling follow-on actions such as malware deployment, lateral movement, persistence, or disruption of services.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by disabling Pragmatic General Multicast where it is not required and preventing untrusted network access to systems and services using PGM. Limit or remove applications listening on PGM ports when operationally feasible until the security update can be deployed.
Patch, then assume compromise.
Apply the Microsoft security updates released on 13 August 2024 for affected Windows versions. Prioritize patching systems where the PGM feature is enabled and RMCAST is exposed through applications listening on PGM ports.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.