{"status":"success","data":{"id":"CVE-2024-38077","slug":"cve-2024-38077-windows-remote-desktop-licensing-service-rce","title":"Windows Remote Desktop Licensing Service (MadLicense) Zero-Click RCE","summary":"Critical unauthenticated remote code execution vulnerability in the Windows Remote Desktop Licensing (RDL) service.","description":"A buffer overflow in the Windows Remote Desktop Licensing (RDL) service allows an unauthenticated remote attacker to execute arbitrary code in the context of the Network Service account by sending specially crafted network requests to an exposed RDL service (port 135/dynamic RPC). Dubbed 'MadLicense', this flaw can be exploited without user interaction.","severity":"CRITICAL","cvss_score":9.8,"cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_metrics":{"scope":"UNCHANGED","integrity":"HIGH","attackVector":"NETWORK","availability":"HIGH","confidentiality":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","privilegesRequired":"NONE"},"epss_score":0.974,"epss_percentile":0.995,"cisa_kev":true,"cisa_date_added":"2024-08-14T00:00:00.000Z","cisa_due_date":"2024-09-04T00:00:00.000Z","ransomware_campaign":"BlackSuit / Royal Ransomware affiliate probes","threat_actors":["FIN7","Storm-0501"],"exploit_status":"weaponized","cwes":[{"id":"CWE-120","name":"Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"},{"id":"CWE-122","name":"Heap-based Buffer Overflow"}],"affected_vendors":["Microsoft"],"affected_products":[{"cpe":"cpe:2.3:o:microsoft:windows_server:*:*:*:*:*:*:*:*","vendor":"Microsoft","product":"Windows Server","fixed_version":"July 2024 Windows Security Updates","affected_versions":"Windows Server 2008, 2012, 2016, 2019, 2022, 2025 with Remote Desktop Licensing role installed"}],"ai_analysis":{"sigma_rule":"title: Windows RDL RPC Binding Suspicious Activity\nstatus: critical\nlogsource:\n  product: windows\n  service: system\ndetection:\n  selection:\n    EventID: 7034\n    param1: 'Remote Desktop Licensing'\n  condition: selection","analyzed_at":"2026-10-28T09:00:00.000Z","model_provider":"Gemini 2.0 Flash Security Sentinel","executive_summary":"Zero-click wormable remote code execution flaw in the Windows Remote Desktop Licensing service. Exposing RDL to the internet or untrusted internal subnets enables immediate network takeover.","detection_guidance":"Monitor Windows Event Logs for crashes of `lserver.exe`. Alert on unexpected RPC traffic binding to UUID `3593a0d5-9952-4326-b735-f03507bfbd81` from external IP ranges.","mitigation_playbook":["Deploy the July 2024 Windows Security Update immediately on all Windows Server instances.","Disable the Remote Desktop Licensing service (`sc config TermServLicensing start= disabled`) on systems where it is not strictly required.","Block RPC endpoint ports (TCP port 135 and dynamic RPC ports 49152-65535) at perimeter firewalls."],"technical_root_cause":"The RDL service exposes RPC endpoints over DCE/RPC. When parsing incoming licensing requests via internal function `DecodeTlsMessage`, buffer lengths are calculated based on attacker-supplied metadata without bound validation, triggering a heap-based buffer overflow.","exploitation_mechanism":"An adversary binds to the Remote Desktop Licensing RPC interface (UUID: 3593a0d5-9952-4326-b735-f03507bfbd81) and sends a malformed packet containing oversized licensing certificates, triggering memory corruption and arbitrary code execution.","enterprise_blast_radius":"Full Domain Controller compromise when RDL is co-located with Active Directory, credential dumping, lateral worm-like propagation across Active Directory domains."},"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38077","type":"advisory","title":"Microsoft MSRC Advisory CVE-2024-38077"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","type":"cisa","title":"CISA KEV Catalog Reference"}],"published_at":"2024-07-09T18:00:00.000Z","updated_at":"2026-10-28T18:00:00.000Z"}}