CVE-2014-6364

Use-after-free vulnerability in Microsoft Office 2007 SP3; 2010 SP2; 2013 Gold, SP1, and SP2; and 2013 RT Gold and SP1 allows remote attackers to execute…

published December 11, 2014

CVSS
—
EPSS
15%
Percentile
96.6
In the wild
Unconfirmed
What it is

⚠️ You might be surprised to find that Microsoft Office has a sneaky use-after-free vulnerability — a crafty document could let attackers run arbitrary code on your system! Think of it like a waiter who forgets to clear away a used plate, and a mischievous diner decides to use it to serve up something entirely unexpected. This vulnerability allows the attacker to exploit leftover memory, taking control of your system without you even noticing! If an attacker sends you a specially crafted Office document, they could execute any code they want on your computer. This means they could steal sensitive information, install malware, or even take over your entire system without you lifting a finger!

Put simply

Think of it like a waiter who forgets to clear away a used plate, and a mischievous diner decides to use it to serve up something entirely unexpected. This vulnerability allows the attacker to exploit leftover memory, taking control of your system without you even noticing! This use-after-free vulnerability occurs when Microsoft Office does not properly manage memory in certain older versions, allowing attackers to exploit the leftover memory space with malicious code through crafted documents.

What to do

If an attacker sends you a specially crafted Office document, they could execute any code they want on your computer. This means they could steal sensitive information, install malware, or even take over your entire system without you lifting a finger! To protect yourself, make sure you're running the latest version of Microsoft Office. Regularly update your software, and consider implementing email filtering to catch potentially harmful attachments. Stay vigilant and be cautious about the documents you open! You've got this! By following these steps, you'll keep your system secure and ready to tackle anything that comes your way! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.14662 · 96.6th percentile
Published
2014-12-11T00:00Z
EPSS history
Timeline
  • 11 DEC 00:00Z
    Use-after-free vulnerability in Microsoft Office 2007 SP3; 2010 SP2; 2013 Gold, SP1, and SP2; and 2013 RT Gold and SP1 allows remote attackers to execute…
    cvelistv5