CVE-2014-6332highunder attackCWE-119

CVE-2014-6332

Published · Updated

Follow this CVE+ Monitor Windows

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.8epss 95%
from disclosure to weapon2 days
Published on NVDNov 11
1st PoC+2d
metasploit+2d
CISA KEV+2691d
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

A flaw in Windows OLE Automation allows attackers to run malicious code on a computer by tricking users into visiting a crafted website. The vulnerability occurs when the system improperly handles array resizing operations, leading to memory corruption.

Technical detail

CVE-2014-6332 is a memory corruption vulnerability in OleAut32.dll's SafeArrayDimen function triggered by specially crafted arrays that exploit improper size validation during array redimensioning. Remote attackers can achieve arbitrary code execution by hosting malicious web content that leverages this flaw when processed through OLE Automation, typically via Internet Explorer or similar COM-based applications.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka "Windows OLE Automation Array Remote Code Execution Vulnerability."
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.