MadLicense
- Product
- Microsoft Windows Remote Desktop Licensing Service
- CVE
- CVE-2024-38077
- Disclosed
- 2024-07-09
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- no
- Affected
- Windows Server 2008 through Server 2025 with the Remote Desktop Licensing role installed (per Microsoft; the researchers say all versions back to Server 2000 are affected).
- Fixed
- July 2024 Patch Tuesday cumulative updates.
Summary
A pre-authentication heap overflow in the Remote Desktop Licensing (RDL) service, named MadLicense by researchers Lewis Lee, Chunyang Han (Ver) and Zhiniang Peng. An unauthenticated attacker sends crafted RPC messages to the licensing service and gets code execution on the server. The researchers' August 2024 write-up and pseudo-code PoC were later deleted.
Root cause
lserver.dll's CDataCoding::DecodeData / TLSRpcTelephoneRegisterLKP path computes a decoded output buffer size from attacker-supplied input without bounds checking, so a crafted license key packet overflows a heap buffer in the TermServLicensing process.
Impact
Unauthenticated RCE on Windows servers running RD Licensing, which researchers estimated at over 170,000 internet-exposed hosts.
Detection
Inventory servers with the RD Licensing role (TermServLicensing service) and verify July 2024 updates. Monitor RPC traffic to the licensing endpoint for anomalous calls.
Mitigation
Apply the July 2024 updates; disable the RD Licensing service where not needed and keep it off the internet.