8.8Yüksek KEV

CVE-2014-6332Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability

microsoft windows 7; microsoft windows 8; microsoft windows 8.1; microsoft windows rt Yayım: 2014-11-12 00:00 (11 yıl önce)

Aktif olarak istismar ediliyor — Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 25.03.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 15.04.2022.

Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2014-6332

Açıklama

OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka "Windows OLE Automation Array Remote Code Execution Vulnerability."

Zayıflık türü (CWE): CWE-119

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
microsoft	windows 7	—
microsoft	windows 8	—
microsoft	windows 8.1	—
microsoft	windows rt	—
microsoft	windows rt 8.1	—
microsoft	windows server 2003	—
microsoft	windows server 2008	r2
microsoft	windows server 2012	r2
microsoft	windows vista	—

Kaynaklar ve yamalar

37668 exploitExploitThird Party AdvisoryVDB Entry
37800 exploitExploitThird Party AdvisoryVDB Entry
VU#158647 third-party-advisoryThird Party AdvisoryUS Government Resource
38512 exploitExploitThird Party AdvisoryVDB Entry
TA14-318B third-party-advisoryThird Party AdvisoryUS Government Resource
MS14-064 vendor-advisoryPatchVendor Advisory
http://packetstormsecurity.com/files/134062/HTML-Compiler-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
70952 vdb-entryThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/134064/Microsoft-Compiled-HTML-Help-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/134053/Avant-Browser-Lite-Ultimate-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
1031184 vdb-entryThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/134061/The-World-Browser-3.0-Final-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
https://forsec.nl/wp-content/uploads/2014/11/ms14_064_ie_olerce.rb_.txt ExploitThird Party Advisory
http://packetstormsecurity.com/files/134079/Winamp-Bento-Browser-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
http://securityintelligence.com/ibm-x-force-researcher-finds-significant-vulnerability-in-microsoft-windows ExploitThird Party Advisory
38500 exploitExploitThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-6332 US Government Resource

CPE eşleşmeleri (NVD) (12)

cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*

CVSS puanı

8.8Yüksek

Kaynak: CISA-ADP · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekir
Kapsam: Değişmez
Gizlilik: Yüksek
Bütünlük: Yüksek
Erişilebilirlik: Yüksek

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tüm puanlar (3)

CISA-ADP	CVSS 3.1	8.8Yüksek
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	8.8Yüksek
nvd	CVSS 2.0	9.3Yüksek

EPSS (30 günde istismar olasılığı)

94.92%

tüm CVE'lerin %100'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: active
Otomatikleştirilebilir: no
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2014-09-11
Yayımlandı2014-11-12 00:00
IP-DB'ye ulaştı2026-10-24 23:33
KEV'e eklendi2022-03-25
Son güncelleme2026-06-17 03:12

Numarayı veren (CNA): microsoft
NVD durumu: Analyzed

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — Windows Server

9.8Kritik

CVE-2026-105016 25 gün önce

Microsoft QUIC Remote Code Execution Vulnerability

Microsoft .NET 10.0 runtime; Microsoft .NET 11.0 runtime; Microsoft .NET 8.0 runtime; Microsoft .NET 9.0 runtime

Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

1.7%EPSS

7.8Yüksek

CVE-2026-108133 25 gün önce

Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability

Microsoft Windows Server 2022

Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.

7.8Yüksek

CVE-2026-108136 25 gün önce

Microsoft Windows Search Component Elevation of Privilege Vulnerability

Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

8.8Yüksek

CVE-2026-108471 25 gün önce

Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

Microsoft Windows 10 Version 1809; Microsoft Windows Server 2019; Microsoft Windows Server 2019 (Server Core installation)

Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

6.5Orta

CVE-2026-108129 25 gün önce

Role: DNS Server Information Disclosure Vulnerability

Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

1.1%EPSS

7.8Yüksek

CVE-2026-108130 25 gün önce

Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

Microsoft Windows 11 Version 24H2; Microsoft Windows 11 Version 25H2; Microsoft Windows 11 version 26H1; Microsoft Windows 11 Version 26H2

Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.