Windows Remote Desktop Licensing Service (MadLicense) Zero-Click RCE

Critical unauthenticated remote code execution vulnerability in the Windows Remote Desktop Licensing (RDL) service.

EPSS Exploit Probability97.40%

99.5th percentile

Exploit Maturityweaponized

Active Weaponization

Primary VendorsMicrosoft

1 product(s) impacted

Ransomware CampaignBlackSuit / Royal Ransomware affiliate probes

Threat intel association

CVSS v3.1 Vector Breakdown

Comprehensive attack metric decomposition according to FIRST specification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV)NETWORKRemotely exploitable over network

Attack Complexity (AC)LOWNo specialized access needed

Privileges Required (PR)NONEUnauthenticated exploitation

User Interaction (UI)NONEZero-click / autonomous

Scope (S)UNCHANGEDSecurity authority boundary

Confidentiality (C)HIGHTotal information disclosure

Integrity (I)HIGHTotal compromise of system state

Availability (A)HIGHComplete resource denial

TechOverwatch AI Security Sentinel Analysis

Model: Gemini 2.0 Flash Security Sentinel · Generated: 2026-10-28

Executive Defense Summary

Zero-click wormable remote code execution flaw in the Windows Remote Desktop Licensing service. Exposing RDL to the internet or untrusted internal subnets enables immediate network takeover.

Technical Root Cause Architecture

The RDL service exposes RPC endpoints over DCE/RPC. When parsing incoming licensing requests via internal function `DecodeTlsMessage`, buffer lengths are calculated based on attacker-supplied metadata without bound validation, triggering a heap-based buffer overflow.

Exploitation Scenario & Attack Chain

An adversary binds to the Remote Desktop Licensing RPC interface (UUID: 3593a0d5-9952-4326-b735-f03507bfbd81) and sends a malformed packet containing oversized licensing certificates, triggering memory corruption and arbitrary code execution.

Enterprise Blast Radius & Lateral Risk

Full Domain Controller compromise when RDL is co-located with Active Directory, credential dumping, lateral worm-like propagation across Active Directory domains.

Remediation & Defense Playbook

Immediate actionable steps for DevOps, SecOps, and Security Architects

1Deploy the July 2024 Windows Security Update immediately on all Windows Server instances.

2Disable the Remote Desktop Licensing service (`sc config TermServLicensing start= disabled`) on systems where it is not strictly required.

3Block RPC endpoint ports (TCP port 135 and dynamic RPC ports 49152-65535) at perimeter firewalls.

Detection Guidance & Threat Hunting

Monitor Windows Event Logs for crashes of `lserver.exe`. Alert on unexpected RPC traffic binding to UUID `3593a0d5-9952-4326-b735-f03507bfbd81` from external IP ranges.

Sigma Detection Rule (SIEM Export)

title: Windows RDL RPC Binding Suspicious Activity
status: critical
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7034
    param1: 'Remote Desktop Licensing'
  condition: selection

Affected Software & CPE Matrix

Targeted versions, patched releases, and Common Platform Enumerations

Vendor	Product	Affected Versions	Fixed In
Microsoft	Windows Server	Windows Server 2008, 2012, 2016, 2019, 2022, 2025 with Remote Desktop Licensing role installed	July 2024 Windows Security Updates

Official Advisories & Authoritative Sources

Microsoft MSRC Advisory CVE-2024-38077https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38077

advisory

CISA KEV Catalog Referencehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog

cisa

AI Agent & Security Automation Hub

TechOverwatch provides native machine-readable endpoints for autonomous agents, Cursor, Claude, ChatGPT, and automated patch scanners.

Agent CLI Command (curl):

curl -s https://www.techoverwatch.in/api/vulnerabilities/CVE-2024-38077/raw

Raw Markdown JSON API