VulnerabilityAnalyzed

CVE-2014-6352

Microsoft Windows Code Injection Vulnerability

KEVEXPLOIT ×6 ✓HIGH 7.8EPSS 77.5%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 25 August 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object, as exploited in the wild in October 2014 with a crafted PowerPoint document.

CVSS 3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 77.48% probability · 100th percentile
Public exploits: 6 in Exploit-DB · verified · first 20 October 2014
CISA KEV: Listed 25 February 2022 · due 25 August 2022
Affected: microsoft/windows 7 · microsoft/windows 8 · microsoft/windows 8.1 · microsoft/windows rt · microsoft/windows rt 8.1 · microsoft/windows server 2008 · microsoft/windows server 2012 · microsoft/windows vista
Source: secure@microsoft.com

EPSS trend

EPSS 77.5% since 30 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

CISA notes

Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2014-6352

Public exploits (6)

Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.

EDB-ID	Title	Type	Published	Verified
EDB-35236 source ↗	Microsoft Windows - OLE Package Manager Code Execution (MS14-064) (Metasploit)windows · Metasploit	local	14 November 2014	yes
EDB-35235 source ↗	Microsoft Windows - OLE Package Manager Code Execution (via Python) (MS14-064) (Metasploit)windows · Metasploit	local	14 November 2014	yes
EDB-35216 source ↗	Microsoft Office 2007/2010 - OLE Arbitrary Command Executionwindows · Abhishek Lyall	local	12 November 2014	no
EDB-35055 source ↗	Microsoft Windows - OLE Remote Code Execution 'Sandworm' (MS14-060)windows · Mike Czumak	remote	25 October 2014	no
EDB-35020 source ↗	Microsoft Windows - OLE Package Manager Code Execution (MS14-060) (Metasploit)windows_x86 · Metasploit	local	20 October 2014	yes
EDB-35019 source ↗	Microsoft Windows - OLE Package Manager SandWormwindows · Vlad Ovtchinikov	local	20 October 2014	no

References

http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspxBroken Link, Patch, Vendor Advisory
http://secunia.com/advisories/61803Broken Link
http://twitter.com/ohjeongwook/statuses/524795124270653440Third Party Advisory
http://www.securityfocus.com/bid/70690Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1031097Broken Link, Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-064Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/97714Third Party Advisory, VDB Entry
https://technet.microsoft.com/library/security/3010060Patch, Vendor Advisory
http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspxBroken Link, Patch, Vendor Advisory
http://secunia.com/advisories/61803Broken Link
http://twitter.com/ohjeongwook/statuses/524795124270653440Third Party Advisory
http://www.securityfocus.com/bid/70690Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1031097Broken Link, Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-064Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/97714Third Party Advisory, VDB Entry
https://technet.microsoft.com/library/security/3010060Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-6352US Government Resource

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.