None

MadLicense: pre-auth, 0-click heap overflow in the Windows Server Remote Desktop Licensing service (lserver.dll). CDataCoding::DecodeData allocates a fixed-size heap buffer (HeapAlloc(hHeap, 8, DAT_0); 21 bytes per the MadLicense research) and decodes a caller-supplied Base24 string into it in a loop bounded only by the string's NUL terminator - the encoded length is never checked against the allocation. Each carry-producing base-24 digit advances the write index and writes _Dst[idx] with no bound, overflowing the buffer with attacker-influenced bytes. Reachable pre-auth via RPC TLSRpcTelephoneRegisterLKP (opnum 49, DCERPC/TCP 135) in the NT AUTHORITY\NETWORK SERVICE process; CVSS 9.8. IN-HOUSE ghidriff diff of Server 2019 10.0.17763.5830 -> .6054 shows the July 2024 fix is TWO layers: (1) a bounds check (DAT_0 <= idx) added at both write sites in DecodeData, GATED behind CFR flag Feature_1932091707_50631810 - with the flag off the patched binary still overflows; (2) a new RPC security callback TLSRpcSecurityCallback, registered via RpcServerRegisterIf2, that rejects callers below RPC_C_AUTHN_LEVEL_PKT_PRIVACY (6) with a registry opt-out DisableWorkgroupAuthEnforcement - this is the layer that removes the pre-auth reachability.

A fixed-size heap buffer is decoded into with no length check, overflowing from an unauthenticated RPC call

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Lewis Lee