# [CVE-2024-38077] Windows Remote Desktop Licensing Service (MadLicense) Zero-Click RCE
**Severity:** CRITICAL | **CVSS Base Score:** 9.8 (3.1)
**CVSS Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
**EPSS Exploit Probability:** 97.40% (Percentile: 99.50%)
**CISA KEV (In The Wild):** YES (Due: Wed Sep 04 2024 00:00:00 GMT+0000 (Coordinated Universal Time))
**Known Ransomware Campaigns:** BlackSuit / Royal Ransomware affiliate probes
**Exploit Status:** weaponized
**Published:** 2024-07-09 | **Updated:** 2026-10-28

## Executive Summary
Critical unauthenticated remote code execution vulnerability in the Windows Remote Desktop Licensing (RDL) service.

## Common Weakness Enumeration (CWE)
- **CWE-120**: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
- **CWE-122**: Heap-based Buffer Overflow

## Affected Vendors & Products
- **Vendor:** Microsoft | **Product:** Windows Server
  - **Affected Versions:** Windows Server 2008, 2012, 2016, 2019, 2022, 2025 with Remote Desktop Licensing role installed
  - **Patched Version:** July 2024 Windows Security Updates

## Technical Root Cause Analysis (AI Defense Agent)
The RDL service exposes RPC endpoints over DCE/RPC. When parsing incoming licensing requests via internal function `DecodeTlsMessage`, buffer lengths are calculated based on attacker-supplied metadata without bound validation, triggering a heap-based buffer overflow.

## Exploitation Mechanism & Attack Scenario
An adversary binds to the Remote Desktop Licensing RPC interface (UUID: 3593a0d5-9952-4326-b735-f03507bfbd81) and sends a malformed packet containing oversized licensing certificates, triggering memory corruption and arbitrary code execution.

## Enterprise Blast Radius
Full Domain Controller compromise when RDL is co-located with Active Directory, credential dumping, lateral worm-like propagation across Active Directory domains.

## Remediation & Mitigation Playbook
1. Deploy the July 2024 Windows Security Update immediately on all Windows Server instances.
2. Disable the Remote Desktop Licensing service (`sc config TermServLicensing start= disabled`) on systems where it is not strictly required.
3. Block RPC endpoint ports (TCP port 135 and dynamic RPC ports 49152-65535) at perimeter firewalls.

## Detection Guidance & Telemetry
Monitor Windows Event Logs for crashes of `lserver.exe`. Alert on unexpected RPC traffic binding to UUID `3593a0d5-9952-4326-b735-f03507bfbd81` from external IP ranges.

### Sigma Detection Rule
```yaml
title: Windows RDL RPC Binding Suspicious Activity
status: critical
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7034
    param1: 'Remote Desktop Licensing'
  condition: selection
```


## References
- [Microsoft MSRC Advisory CVE-2024-38077](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38077) (advisory)
- [CISA KEV Catalog Reference](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (cisa)