Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-54995 — Microsoft Windows Reliable Multicast Transport Driver Integer Underflow

aretiq.ai | research | CVE-2026-54995 | #rce | #vulnerability-research | #windows-security | #integer-underflow | #windows-kernel | #cve-2026-54995 | #rmcast | #multicast

Summary

CVE-2026-54995: an integer underflow in Windows' rmcast.sys PGM FEC handling corrupts a parity counter, enabling memory corruption and potential kernel RCE via crafted multicast packets.
CVE
CVE-2026-54995
Published
Collected

original ↗

Related coverage

High · vulnerability · github.com
CVE-2026-42980 PoC: Windows kernel WMI integer underflow local privilege escalation
The public code turns a Windows kernel integer underflow into local escalation from a normal user to SYSTEM, making it relevant to authorized kernel research and patch validation. Reproduction should be limited to owned, isolated, recoverable systems, and Microsoft fixes should be applied promptly.
research · starlabs.sg
Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE
Post-auth RCE in Cisco Smart Software Manager (CSSM): command injection in nginx certificate upload, where openssl checks run via childProcess.execSync. Cisco silently patched it in 10-202608.
research · idnsec.com
Mitigating RCE Impact Like in OpenAI Hack with Defense-in-Depth
Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.
research · starlabs.sg
Old Bug, Harder Rules : Exploiting CVE-2023-36802 Without the Usual Shortcuts
Exploiting CVE-2023-36802, a type confusion in Microsoft's mskssrv.sys driver, without the usual shortcuts: no NtQuery* leaks or PreviousMode read/write, only what works under current mitigations.
research · projectzero.google
Finding and exploiting ntpd vulnerabilities
A Google Project Zero guest post telling how one of the researchers found and exploited vulnerabilities in the ntpd network time server.
vulnerability · idnsec.com
[CVE-2026-93485] Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core
An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.
back