CVE-2024-38138: Windows Server 2016 RCE Vulnerability

CVE-2024-38138 Overview

CVE-2024-38138 is a remote code execution vulnerability in Windows Deployment Services (WDS) affecting multiple Windows Server releases. The flaw is rooted in a use-after-free condition [CWE-416] within the WDS component, which handles network-based operating system deployment through PXE boot. An authenticated attacker with low privileges can exploit the flaw over the network to execute code in the context of the WDS service. Microsoft rates the issue with a CVSS 3.1 base score of 7.5. Successful exploitation impacts confidentiality, integrity, and availability of affected Windows Server systems used for imaging and provisioning workloads.

Critical Impact
Successful exploitation allows remote code execution against Windows Deployment Services on Windows Server 2016, 2019, 2022, and 2022 23H2, undermining a core infrastructure provisioning role.

Affected Products

Microsoft Windows Server 2016
Microsoft Windows Server 2019
Microsoft Windows Server 2022 (including 23H2)

Discovery Timeline

2024-08-13 - CVE-2024-38138 published to NVD as part of Microsoft's August 2024 security update cycle
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38138

Vulnerability Analysis

The vulnerability resides in the Windows Deployment Services role, a server component that delivers OS images to bare-metal or virtual clients via PXE and TFTP. Microsoft classifies the defect as a use-after-free issue [CWE-416], where memory freed during request processing can later be dereferenced by the WDS service. An attacker who can reach the WDS network interface and authenticate with low privileges can craft a request sequence that reuses freed memory. Reliable exploitation requires precise timing or state manipulation, which is reflected in the high attack complexity rating. Because WDS typically runs with elevated service privileges, code execution yields significant control over the deployment server.

Root Cause

The root cause is improper lifecycle management of an object within the WDS service. A code path frees a heap-allocated structure while another path retains and later dereferences a pointer to that structure. When the freed memory is reallocated with attacker-controllable content, the dangling reference is used to redirect execution or corrupt state.

Attack Vector

The attack vector is network-based. An attacker must have low-privilege access on the network path to the WDS server and must win a race or reproduce a specific sequence of protocol operations against the deployment service. No user interaction is required, but exploitation reliability is limited by the timing conditions, aligning with the high attack complexity component of the CVSS vector.

No public proof-of-concept or in-the-wild exploitation has been reported for CVE-2024-38138. Refer to the Microsoft CVE-2024-38138 Update for the vendor's technical guidance.

Detection Methods for CVE-2024-38138

Indicators of Compromise

Unexpected WDSServer.exe crashes, restarts, or Windows Error Reporting entries on servers with the WDS role enabled.
New or anomalous child processes spawned by the WDS service account outside the normal image deployment workflow.
Malformed or truncated PXE/TFTP requests logged around the time of service instability.
Outbound connections from a WDS server to unfamiliar destinations shortly after suspicious client interactions.

Detection Strategies

Monitor Windows Event Log channels for WDS service errors, access violations, and abnormal termination events on Windows Server 2016, 2019, and 2022 hosts.
Baseline expected PXE/TFTP client behavior and alert on high volumes of malformed deployment requests from unauthenticated or unexpected sources.
Correlate WDS process crashes with subsequent process creation events under the NT AUTHORITY\SYSTEM or WDS service context.

Monitoring Recommendations

Restrict and log network access to UDP 67/69 and TCP ports used by WDS, feeding telemetry into a centralized SIEM for correlation.
Enable Sysmon process creation and network connection logging on servers hosting the WDS role.
Review Microsoft Defender and endpoint telemetry for behavioral detections tied to memory corruption or exploitation of Windows services.

How to Mitigate CVE-2024-38138

Immediate Actions Required

Apply the August 2024 Microsoft security updates that remediate CVE-2024-38138 on all Windows Server 2016, 2019, 2022, and 2022 23H2 systems running the WDS role.
Inventory all servers with the Windows Deployment Services role enabled and prioritize those exposed to broader network segments.
Restrict network access to WDS listeners so only authorized provisioning subnets and management hosts can reach the service.

Patch Information

Microsoft addressed CVE-2024-38138 in the August 2024 Patch Tuesday release. Deploy the cumulative update referenced in the Microsoft CVE-2024-38138 Update advisory for each affected Windows Server version. Confirm patch installation via update history and reboot the server to complete servicing operations.

Workarounds

Disable the Windows Deployment Services role on servers where PXE-based provisioning is not required until patching is complete.
Segment WDS servers onto an isolated provisioning VLAN and enforce firewall rules that limit inbound traffic to trusted deployment clients.
Require strong authentication and least-privilege service accounts for any process interacting with the deployment infrastructure.

bash

# Configuration example: disable the WDS role temporarily on Windows Server
Uninstall-WindowsFeature -Name WDS -IncludeManagementTools

# Or stop and disable the WDS service until patching completes
Stop-Service -Name WDSServer
Set-Service -Name WDSServer -StartupType Disabled