CVE-2024-38077
Published: 09 July 2024
Summary
CVE-2024-38077 is a critical-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-38077 is a remote code execution vulnerability in the Windows Remote Desktop Licensing Service, carrying a CVSS 3.1 base score of 9.8. The flaw is tracked under CWE-122 and affects the licensing component responsible for managing Remote Desktop client access licenses on Windows servers.
An unauthenticated attacker with network access can exploit the issue over the network without user interaction. Successful exploitation grants the ability to execute arbitrary code with the privileges of the service, enabling full system compromise including data access, persistence, and lateral movement.
Microsoft's security advisory at msrc.microsoft.com directs administrators to apply the updates released on July 9, 2024, which remediate the vulnerability in supported Windows versions. The associated EPSS score has remained consistently high, with a current value of 0.8999 and a recorded peak of 0.9028.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37771
Vulnerability details
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.