CVE-2014-6352highunder attack

CVE-2014-6352

Published 22 Oct 2014 · Updated 22 Oct 2025

Follow this CVE + Monitor Windows

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 3 threat group(s) use it.

ssvc Actcvss 7.8epss 77%

from disclosure to weaponsame day

Published on NVDOct 22

1st PoCOct 20

metasploitOct 21

CISA KEV+2683d

Who exploits it — 3

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateAPT33🇮🇷 MITRE ATT&CK

APT / StateBlackTech🇨🇳 MITRE ATT&CK

APT / StatePatchwork🇮🇳 MITRE ATT&CK

Action required by CISAfederal deadline: 2022-08-25

Apply updates per vendor instructions.

In short

A vulnerability in Windows allows attackers to run malicious code by sending a specially crafted file (like a PowerPoint document) that exploits how Windows handles OLE objects. This is dangerous because attackers can take full control of your computer just by tricking you into opening a file.

Technical detail

Remote code execution vulnerability in Windows OLE object handling affecting multiple versions (Vista through Windows 8.1 and Server 2012). Attack vector is user interaction via malicious OLE-embedded documents; the vulnerability allows arbitrary code execution with privileges of the user opening the crafted file. Exploitation was observed in the wild via specially crafted PowerPoint files in October 2014.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object, as exploited in the wild in October 2014 with a crafted PowerPoint document.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

n/a · n/a

public PoCs found — 6✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/35236 exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/35020 exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/35235 exploitdbwww.exploit-db.com/exploits/35216unverified exploitdbwww.exploit-db.com/exploits/35019unverified exploitdbwww.exploit-db.com/exploits/35055unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-064 http://secunia.com/advisories/61803 https://exchange.xforce.ibmcloud.com/vulnerabilities/97714 https://technet.microsoft.com/library/security/3010060 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-6352 http://twitter.com/ohjeongwook/statuses/524795124270653440 http://www.securityfocus.com/bid/70690 http://www.securitytracker.com/id/1031097