CVE-2014-4114highunder attack

CVE-2014-4114

Published · Updated

Follow this CVE+ Monitor Windows

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 3 threat group(s) use it.

ssvc Actcvss 7.8epss 82%
from disclosure to weapon5 days
Published on NVDOct 15
1st PoC+5d
metasploitOct 14
CISA KEV+2696d
Who exploits it — 3

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateBRONZE BUTLER🇨🇳 MITRE ATT&CK
APT / StatePatchwork🇮🇳 MITRE ATT&CK
APT / StateSandworm Team🇷🇺 MITRE ATT&CK
Action required by CISAfederal deadline: 2022-03-24

Apply updates per vendor instructions.

In short

A flaw in Windows allows attackers to run malicious code by embedding a specially crafted object in Office documents (like Word or Excel). When someone opens the document, the code executes automatically without needing additional user actions.

Technical detail

Remote code execution vulnerability in Windows OLE (Object Linking and Embedding) handling affecting multiple OS versions. Attack vector is user interaction with Office documents containing malicious OLE objects; execution occurs in the security context of the user opening the file. Impacts confidentiality, integrity, and availability through arbitrary code execution.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a "Sandworm" attack in June through October 2014, aka "Windows OLE Remote Code Execution Vulnerability."
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.