CVE-2014-6332KEV · OVERDUE

Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability

High · published November 11, 2014

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

1652
days past CISA
deadline
CVSS v3.1
8.8
EPSS
95%
Percentile
99.9
In the wild
Confirmed
What it is

🚨 A single crafted website can open the door to total chaos! This vulnerability in OleAut32.dll lets attackers execute arbitrary code with just a web visit. 🔥 Think of it like a restaurant that serves food without checking the ingredients. If a dish is prepared with a harmful secret ingredient, anyone who orders it is in for a nasty surprise. An attacker could run wild on the system, performing actions such as stealing sensitive information, installing malware, or completely taking over the machine. It’s a recipe for disaster that could have devastating impacts on your organization’s security!

Put simply

Think of it like a restaurant that serves food without checking the ingredients. If a dish is prepared with a harmful secret ingredient, anyone who orders it is in for a nasty surprise. This vulnerability arises in the SafeArrayDimen function, where improper handling of size values allows attackers to manipulate memory and gain control over the affected system. It affects multiple versions of Windows, making it a widespread threat.

What to do

An attacker could run wild on the system, performing actions such as stealing sensitive information, installing malware, or completely taking over the machine. It’s a recipe for disaster that could have devastating impacts on your organization’s security! To protect your system, make sure to patch to the latest versions available for your Windows operating system. Additionally, consider implementing network security measures to block access to potentially harmful sites. Regularly update your security protocols and educate users about the risks of visiting untrustworthy websites. You've got this! Follow these steps and you’ll have your defenses up in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.94918 · 99.9th percentile
Published
2014-11-11T22:00Z
KEV added
2022-03-25 · due 2022-04-15
EPSS history
Timeline
  • 25 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 15
    kev
  • 11 NOV 22:00Z
    OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows…
    cvelistv5