Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

Affected versions from Win server 2000 to Win server 2025

A hole in the Windows Remote Desktop Licensing (RDL) service, 170,000 such hosts are currently exposed on the Internet.
Patched in July

PoC exploit released for critical 0-click remote code execution (RCE) vulnerability affecting Windows Server. This flaw impacts Windows Server versions from 2000 to the latest 2025 preview.

This vulnerability, identified as CVE-2024-38077, resides in the Windows Remote Desktop Licensing Service and poses a significant threat due to its ability to be exploited without any user interaction.

The flaw is rooted in a heap overflow vulnerability within the CDataCoding::DecodeData function. This function improperly handles user-controlled input, leading to a buffer overflow condition.