CVE-2024-38071: Windows Server 2008 DOS Vulnerability

CVE-2024-38071 Overview

CVE-2024-38071 is a denial of service vulnerability in the Windows Remote Desktop Licensing Service. The flaw affects multiple Windows Server versions from 2008 through 2022 23H2. An unauthenticated attacker can exploit this vulnerability over the network without user interaction. Microsoft addressed the issue in the July 2024 Patch Tuesday release. The vulnerability carries a CVSS score of 7.5 and is associated with [CWE-126] (Buffer Over-read). The EPSS percentile of 98.26 indicates a high probability of exploitation activity relative to other vulnerabilities, though no public exploit or CISA KEV entry exists at this time.

Critical Impact
A remote, unauthenticated attacker can disrupt the Remote Desktop Licensing Service, breaking RDS infrastructure that enterprises rely on for user licensing and session management.

Affected Products

Microsoft Windows Server 2008 SP2 and 2008 R2 SP1
Microsoft Windows Server 2012 and 2012 R2
Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

2024-07-09 - CVE-2024-38071 published to NVD and addressed in Microsoft's July 2024 security update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38071

Vulnerability Analysis

The vulnerability resides in the Windows Remote Desktop Licensing (RDL) Service, a component that manages Remote Desktop Services (RDS) client access licenses (CALs). The service typically listens on TCP and handles RPC-based licensing requests from RDS hosts. Successful exploitation causes the service to crash or become unresponsive, denying license issuance to dependent Remote Desktop Session Hosts. The vulnerability does not affect confidentiality or integrity, but it eliminates availability for licensing operations across the dependent RDS environment.

Root Cause

The vulnerability is classified under [CWE-126] (Buffer Over-read). A buffer over-read occurs when the service reads data past the intended end of a buffer while parsing a malformed licensing protocol message. The over-read condition produces an unrecoverable error state that terminates the service process.

Attack Vector

The attack vector is network-based with low attack complexity and no privileges or user interaction required. An attacker sends a crafted RPC request to the Remote Desktop Licensing Service over the network. Any host that exposes the licensing service to attacker-reachable network segments is vulnerable. Internet-exposed RDS licensing endpoints, while uncommon in mature environments, present the highest exposure risk.

No verified public proof-of-concept code is available. See the Microsoft Security Update for CVE-2024-38071 for vendor technical details.

Detection Methods for CVE-2024-38071

Indicators of Compromise

Unexpected termination or repeated restarts of the TermServLicensing service on Windows Server hosts running the RDL role
Application or System event log entries showing service crash events tied to the Remote Desktop Licensing Service
Spikes in inbound RPC traffic to RDL hosts from unexpected source addresses
RDS Session Hosts logging license server unavailability or failed CAL issuance events

Detection Strategies

Monitor Windows Service Control Manager events (Event ID 7031, 7034) for TermServLicensing unexpected stops
Alert on anomalous RPC endpoint mapper (TCP 135) traffic patterns targeting RDL hosts
Correlate licensing failure events on RDS Session Hosts with crash events on the licensing server

Monitoring Recommendations

Enable verbose logging on the Remote Desktop Licensing Service and forward Windows Event Logs to a centralized SIEM
Track service uptime metrics for TermServLicensing and alert on availability drops
Audit network exposure of RDL hosts to confirm the service is not reachable from untrusted networks

How to Mitigate CVE-2024-38071

Immediate Actions Required

Apply the July 2024 Microsoft security updates to all Windows Server systems running the Remote Desktop Licensing role
Inventory hosts with the RDL role enabled and prioritize patching for any internet-facing or DMZ-resident systems
Verify backup license servers are patched before failing services over during remediation

Patch Information

Microsoft released fixes as part of the July 2024 security update cycle. Refer to the Microsoft Security Update Guide for CVE-2024-38071 for the specific KB articles aligned to each affected Windows Server version.

Workarounds

Restrict network access to the Remote Desktop Licensing Service using host-based firewall rules limiting RPC traffic to trusted RDS Session Hosts
Place RDL servers behind network segmentation that blocks untrusted inbound traffic to RPC endpoints
Disable the Remote Desktop Licensing role on hosts that do not require it until patches are applied

bash

# Example: Restrict RPC endpoint access to specific trusted RDS hosts via Windows Firewall
New-NetFirewallRule -DisplayName "Restrict RDL RPC" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 135 `
  -RemoteAddress 10.0.0.0/24 `
  -Action Allow