A Proof-of-Concept (PoC) exploit has been released for a severe 0-click remote code execution (RCE) vulnerability that impacts Windows Server. This flaw affects all versions of Windows Server from 2000 through the most recent 2025 preview.
Designated as CVE-2024-38077, the vulnerability is found in the Windows Remote Desktop Licensing Service and is particularly dangerous because it can be exploited without any user interaction. This vulnerability, known as “MadLicense,” is a pre-authentication RCE flaw that permits attackers to run arbitrary code on affected systems without needing user input.
In contrast to many RCE vulnerabilities that require some level of user interaction, CVE-2024-38077 can be exploited without any user involvement.
This issue is especially alarming given the widespread deployment of the Remote Desktop Licensing Service, which is frequently used on servers that have Remote Desktop Services enabled. The service handles the distribution and management of licenses for remote desktop access, making it a critical component in many organizational infrastructures.
Exploit Released – MadLicense
The flaw is rooted in a heap overflow vulnerability within the CDataCoding::DecodeData function. This function mishandles user-controlled input, leading to a buffer overflow condition.
Researchers Ver, Lewis Lee, and Zhiniang Peng have released a PoC exploit that demonstrates how this vulnerability can bypass modern security defenses in Windows Server 2025, achieving complete remote code execution capabilities. The exploit operates by manipulating the licensing service to load a remote DLL, allowing attackers to execute arbitrary shellcode within the service’s process. Although the PoC is presented in pseudocode and deliberately obfuscated to prevent misuse, it underscores the severity of the vulnerability and the ease with which it can be exploited.
With over 170,000 Remote Desktop Licensing Services exposed to the public internet, the potential impact of this vulnerability is considerable. Its 0-click nature makes it especially perilous, as it can be exploited without any user interaction, heightening the risk of widespread attacks.
Microsoft has been notified of this vulnerability, initially categorizing its exploitation as “less likely.” Despite this, security experts stress the urgency of patching affected systems to avoid potential exploitation.
“We have shown how a single vulnerability can bypass all mitigations and enable a pre-authentication remote code execution (RCE) attack on Windows Server 2025, which is supposed to be the most secure version of Windows Server to date,” the researchers noted.
Organizations are strongly advised to apply Microsoft’s latest security patches to mitigate the risk. Network administrators should also consider additional security measures such as network segmentation and strict access controls to minimize the attack surface.
The researchers behind this discovery followed responsible disclosure protocols, providing Microsoft with comprehensive details about the vulnerability and its exploitability. Their goal is to raise awareness of the associated risks and encourage prompt action to secure vulnerable systems.
Although Microsoft initially downplayed the likelihood of this vulnerability being exploited, the PoC demonstrates that it can defeat modern security measures, even on the latest Windows Server 2025, which is intended to deliver advanced security enhancements.
As of now, there are no known active exploits targeting the CVE-2024-38077 vulnerability. Microsoft has released a patch, and it is imperative that users apply this update to protect against potential threats.
