#VU97009 Use of uninitialized resource in Windows Server - CVE-2024-38260

Vulnerability identifier: #VU97009

Vulnerability risk: Medium

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-38260

CWE-ID: CWE-908

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Windows Server
Operating systems & Components / Operating system

Vendor: Microsoft

Description

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to usage of uninitialized resources in Windows Remote Desktop Licensing Service. A remote user can pass specially crafted data to the application, trigger uninitialized usage of resources and execute arbitrary code on the target system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Windows Server: before 2008 R2, 2012 R2, 2012, 2016, 2019, 2022 23H2, 2022, 2008 R2, 2008 R2, 2008 R2, 2008 R2, 2008 R2

---

External links
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-38260

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.