CVE-2024-38073
Published: 09 July 2024
Summary
CVE-2024-38073 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 8.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
This vulnerability is a denial-of-service issue, tracked as CVE-2024-38073, that affects the Windows Remote Desktop Licensing Service. It carries a CVSS 3.1 base score of 7.5 and is associated with CWE-125. The flaw permits an unauthenticated network attacker to trigger a crash or resource exhaustion in the service without any user interaction.
An attacker with network reachability can send crafted requests that exploit the out-of-bounds read condition, resulting in high availability impact while leaving confidentiality and integrity unaffected. No privileges or special configuration are required, making the service reachable over the network the primary prerequisite for exploitation.
Microsoft’s Security Response Center advisory, published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38073, supplies the official guidance on available patches and mitigation steps. The associated EPSS score has remained essentially flat, with a current value of 0.0645 and a recorded peak of 0.0661.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37768
Vulnerability details
Windows Remote Desktop Licensing Service Denial of Service Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.