PT-2024-9357 · Microsoft · Windows Remote Desktop Services+1

K0Shl · Published 2024-12-10 · Updated 2025-11-27 · CVE-2024-49115

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The Windows Remote Desktop Services is affected by a critical security flaw that allows remote attackers to execute arbitrary code and impact the system. This issue is present in Windows Remote Desktop Services, but the specific vulnerable versions are not specified in the given text. The exploit for this issue can be found on various online platforms, but no direct link to a trusted source is provided here. It's worth noting that this security flaw could potentially affect a large number of Internet users, given the widespread use of Windows Remote Desktop Services. #WindowsRemoteDesktopServices #RemoteCodeExecution #Microsoft #Windows #RDP #CyberSecurity #RemoteAttack #CodeExecution #WindowsVulnerability

Fix

RCE

Use After Free

Race Condition

Weakness Enumeration

CWE-591

CWE-416

CWE-362

Related Identifiers

BDU:2024-11047

CVE-2024-49115

Affected Products

Windows

Windows Remote Desktop Services

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-49115 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/714627 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-49115 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49115 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49115 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-11047 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49115 · Vendor Advisory
• https://t.me/cvenotify/107329 · Telegram Post
• https://twitter.com/The_Cyber_News/status/1866783515637059970 · Twitter Post
• https://reddit.com/r/VPNforFreedom/comments/1p7titr/remote_desktop_vs_client_vpn · Reddit Post
• https://twitter.com/fletch_ai/status/1867102294497698274 · Twitter Post
• https://twitter.com/Shadowserver/status/1867526298937020449 · Twitter Post