CVE-2014-4114KEV · OVERDUE

Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability

High · published October 15, 2014

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 99.6th percentile for exploit probability.

1674
days past CISA
deadline
CVSS v3.1
7.8
EPSS
82%
Percentile
99.6
In the wild
Confirmed
What it is

🚨 An OLE object in your Office documents could be the door to disaster! This vulnerability has been exploited in the wild, and it’s time to take action. ⚡ Think of this vulnerability like an unmarked package delivered to your office. If no one checks its contents before opening, it could unleash a world of chaos, allowing anyone inside to wreak havoc without you ever realizing it. An attacker can execute arbitrary code on your system, potentially allowing them to take control of your machine, steal sensitive data, or deploy malware - absolutely devastating consequences that can disrupt your whole operation.

Put simply

Think of this vulnerability like an unmarked package delivered to your office. If no one checks its contents before opening, it could unleash a world of chaos, allowing anyone inside to wreak havoc without you ever realizing it. This vulnerability allows remote attackers to exploit a crafted OLE object in Office documents to execute arbitrary code on vulnerable installations of Microsoft Windows, affecting several versions including Windows 7 and Windows 8.1.

What to do

An attacker can execute arbitrary code on your system, potentially allowing them to take control of your machine, steal sensitive data, or deploy malware - absolutely devastating consequences that can disrupt your whole operation. Patch your systems immediately! Microsoft has released updates to address this vulnerability, so ensure you're running the latest versions. Additionally, educate users about safe document handling and enable security features where possible. You're on your way to becoming a security hero! Follow these steps and keep those systems safe. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.81628 · 99.6th percentile
Published
2014-10-15T10:00Z
KEV added
2022-03-03 · due 2022-03-24
EPSS history
Timeline
  • 03 MAR 00:00Z
    Added to CISA KEV — remediate by Mar 24
    kev
  • 15 OCT 10:00Z
    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold…
    cvelistv5