MSRC-CVE-2024-38076 — Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

Summary

Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An attacker could send a specially crafted packet to a server set up as a Remote Desktop Licensing server, which will cause remote code execution.

Security updates
10.0.17763.6054 — https://support.microsoft.com/help/5040430
10.0.20348.2582 — https://support.microsoft.com/help/5040437
10.0.25398.1009 — https://support.microsoft.com/help/5040438
10.0.14393.7159 — https://support.microsoft.com/help/5040434

Vulnerabilities 1

Critical 9.8

CVE-2024-38076

Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows

Jul 9, 2024

Revision history

2024-07-09 #1
Information published.

References

CVE-2024-38076 Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38076
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss