Cyber Resilience

CVE-2024-38071

High

Published: 09 July 2024

Published
09 July 2024
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.2707 96.5th percentile
Risk Priority 31 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-38071 is a high-severity Buffer Over-read (CWE-126) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 3.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2024-38071 is a denial-of-service vulnerability in the Windows Remote Desktop Licensing Service. It carries a CVSS 3.1 base score of 7.5 and is associated with CWE-126. The flaw permits an unauthenticated network attacker to disrupt service availability without any user interaction or privileges.

An attacker can send specially crafted requests over the network to trigger the condition, resulting in high impact to availability while leaving confidentiality and integrity unaffected. No authentication or user interaction is required, making remote exploitation feasible from anywhere with network reachability to an exposed licensing service.

Microsoft has published guidance for the issue at the MSRC update guide. The EPSS score rose from a low baseline to a peak of 0.5016 on 2026-01-13 before receding to the current value of 0.2707, indicating a clear post-disclosure increase in observed exploitation interest.

EU & UK References

Vulnerability details

Windows Remote Desktop Licensing Service Denial of Service Vulnerability

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

microsoft
windows server 2008
all versions, r2
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
≤ 10.0.14393.7159
microsoft
windows server 2019
≤ 10.0.17763.6054
microsoft
windows server 2022
≤ 10.0.20348.2582
microsoft
windows server 2022 23h2
≤ 10.0.25398.1009

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References