cbcvebase.
CVE-2024-38140
published 2024-08-13

CVE-2024-38140: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

PriorityP264critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.81%
88.9th percentile
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

Affected

49 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10_1507< 10.0.10240.2075110.0.10240.20751
microsoftwindows_10_1607< 10.0.14393.725910.0.14393.7259
microsoftwindows_10_1809< 10.0.17763.618910.0.17763.6189
microsoftwindows_10_21h2< 10.0.19044.478010.0.19044.4780
microsoftwindows_10_22h2< 10.0.19045.478010.0.19045.4780
microsoftwindows_10_version_1507>= 10.0.10240.0 < 10.0.10240.2075110.0.10240.20751
microsoftwindows_10_version_1607>= 10.0.14393.0 < 10.0.14393.725910.0.14393.7259
microsoftwindows_10_version_1809>= 10.0.17763.0 < 10.0.17763.618910.0.17763.6189
microsoftwindows_10_version_21h2>= 10.0.19043.0 < 10.0.19044.478010.0.19044.4780
microsoftwindows_10_version_22h2>= 10.0.19045.0 < 10.0.19045.478010.0.19045.4780
microsoftwindows_11_21h2< 10.0.22000.314710.0.22000.3147
microsoftwindows_11_22h2< 10.0.22621.403710.0.22621.4037
microsoftwindows_11_23h2< 10.0.22631.403710.0.22631.4037
microsoftwindows_11_24h2< 10.0.26100.145710.0.26100.1457
microsoftwindows_11_version_21h2>= 10.0.0 < 10.0.22000.314710.0.22000.3147
microsoftwindows_11_version_22h2>= 10.0.22621.0 < 10.0.22621.403710.0.22621.4037
microsoftwindows_11_version_22h3>= 10.0.22631.0 < 10.0.22631.403710.0.22631.4037
microsoftwindows_11_version_23h2>= 10.0.22631.0 < 10.0.22631.403710.0.22631.4037
microsoftwindows_11_version_24h2>= 10.0.26100.0 < 10.0.26100.145710.0.26100.1457
microsoftwindows_server_2008
microsoftwindows_server_2008_r2_service_pack_1>= 6.1.7601.0 < 6.1.7601.272776.1.7601.27277
microsoftwindows_server_2008_service_pack_2>= 6.0.6003.0 < 6.0.6003.228256.0.6003.22825
microsoftwindows_server_2012< 6.2.9200.250316.2.9200.25031
microsoftwindows_server_2012
microsoftwindows_server_2012>= 6.2.9200.0 < 6.2.9200.250316.2.9200.25031

Detection & IOCsextracted from sources · hover to see the quote

portPGM port (UDP 13001)
  • Monitor for any process actively listening on a PGM (Pragmatic General Multicast) socket/port; exploitation requires an open PGM receiver socket on the target.
  • Alert on inbound specially crafted PGM packets to Windows hosts with an open PGM socket, particularly from unauthenticated/external sources — PGM does not authenticate requests.
  • Detect exploitation attempts targeting the Windows Reliable Multicast Transport Driver (RMCAST) via anomalous or malformed PGM packets sent to open sockets without user interaction.
  • ·Exploitation is only possible if a program is actively listening on a PGM port; systems with PGM installed but no active receiver are NOT exploitable.
  • ·Network-level controls (e.g., firewall blocking PGM ports) are a recommended mitigation; PGM receivers should never be exposed to the public internet.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_msrc9.8CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.