{"answers":{"affected":"It affects 9 products.","exploited":"Yes. Attackers have exploited CVE-2014-6332 in the wild since at least 25 Mar 2022.","fix":"No fix has been published for CVE-2014-6332 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 15 Apr 2022.","what":"CVE-2014-6332 is a high-severity memory corruption vulnerability in Microsoft Windows 7, published on 11 Nov 2014. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2014-6332 and fix it if it is affected.\n\nWhat it is: CVE-2014-6332 is a high-severity memory corruption vulnerability in Microsoft Windows 7, published on 11 Nov 2014. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: Yes. Attackers have exploited CVE-2014-6332 in the wild since at least 25 Mar 2022.\n\nAffected product: Microsoft Windows 7. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2014-6332/ (Markdown: https://insights.sbomify.com/CVE-2014-6332/index.md)","id":"CVE-2014-6332","markdown":"https://insights.sbomify.com/CVE-2014-6332/index.md","name":"CVE-2014-6332","record":{"aliases":["GHSA-w64p-pvrc-c5w3"],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Windows OLE Automation","requires_auth":"none","summary":"Remote attackers can execute arbitrary code via a crafted website exploiting improper size handling in Windows OLE Automation.","user_interaction":"required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"microsoft","cpe":[{"product":"windows_7","vendor":"microsoft"},{"product":"windows_8","vendor":"microsoft"},{"product":"windows_8.1","vendor":"microsoft"},{"product":"windows_rt","vendor":"microsoft"},{"product":"windows_rt_8.1","vendor":"microsoft"},{"product":"windows_server_2003","vendor":"microsoft"},{"product":"windows_server_2008","vendor":"microsoft"},{"product":"windows_server_2012","vendor":"microsoft"},{"product":"windows_vista","vendor":"microsoft"}],"cvss":{"score":8.8,"severity":"high","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"description":"OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka \"Windows OLE Automation Array Remote Code Execution Vulnerability.\"","ecosystems":[],"exploits":{"exploitdb":9,"first_seen":"2014-11-13","github_poc":3,"max_poc_stars":5,"metasploit":1,"nuclei":0,"refs":[{"date":"2014-11-29T11:01:01Z","kind":"github_poc","ref":"https://github.com/MarkoArmitage/metasploit-framework","stars":5,"title":" app \tturn nil publics and privates into blanks \t3 months ago \tconfig \tUse bundler/setup for more graceful bundler related failures \t11 days ago \tdata \tAdd token fiddling from nishang \t12 hours ago \tdb \tRevert \"Diff triggering comment\" \t12 days ago \tdocumentation \tSwitch to Msf::OperatingSystems::Match::WINDOWS \t2 months ago \texternal \tUse PDWORD_PTR and DWORD_PTR \t29 days ago \tfeatures \tUp aruba timeout for simplecov overhead \t4 days ago \tlib \tCheck for load errors in reload_all \t4 days ago \tmodules \tLand #4255 - CVE-2014-6332 Internet Explorer \t19 hours ago \tplugins \tLand #3588, @tobd-r7's Fix SpaceBeforeModifierKeyword Rubocop warning \t4 months ago \tscript \trails generate cucumber:install \t3 months ago \tscripts \tdelete the old script \ta month ago \tspec \tRemove debug file writes \t2 days ago \ttest \tFix up comment splats with the correct URI \ta month ago \ttools \tFix bugs \t24 days ago \t.gitignore \tAdd note about rbenv for rvm .versions.conf local override \t24 days ago \t.gitmodules \tAdd RDI submodule, port Kitrap0d \ta year ago \t.mailmap \tAdd @trosen-r7's alias for commits \t6 months ago \t.rspec \tAdd modern --require to .rspec \t2 months ago \t.rubocop.yml \tReapply PR #4113 (removed via #4175) \t18 days ago \t.ruby-gemset \tRestoring ruby and gemset files \t6 months ago \t.ruby-version \tOh good, another Ruby version bump \t14 days ago \t.simplecov \tRemove fastlib \t2 months ago \t.travis.yml \tEnable fast_finish on travis-ci \t12 days ago \t.yardopts \tVarious merge resolutions from master \u003c- staging \t4 months ago \tCONTRIBUTING.md \tAdd a don't to CONTRIBUTING about merge messages \t11 days ago \tCOPYING \tWith 66 days left in 2014, may as well update \ta month ago \tGemfile \tmetasploit-credential bump to 0.13.3 \t16 days ago \tGemfile.local.example \tVarious merge resolutions from master \u003c- staging \t4 months ago \tGemfile.lock \tBump mdm version number \t12 days ago \tHACKING \tUpdate link for The Metasploit Development Environment \t5 months ago \tLICENSE \tRemove fastlib \t2 months ago \tREADME.md \tEncourage use of the installer for users. \t8 months ago \tRakefile \tMerge branch 'feature/MSP-11130/metasploit-framework-spec-constants' … \t24 days ago \tmetasploit-framework-db.gemspec \tmetasploit-credential bump to 0.13.3 \t16 days ago \tmetasploit-framework-full.gemspec \tUpdate metasploit-framework-full.gemspec \t23 days ago \tmetasploit-framework-pcap.gemspec \tDepend on metasloit-framework in optional gemspecs \t24 days ago \tmetasploit-framework.gemspec \tUpdate meterpreter_bins to 0.0.11 \t18 days ago \tmsfbinscan \tRemove fastlib \t2 months ago \tmsfcli \tFix thread-leaks in msfcli spec \t17 days ago \tmsfconsole \t@wvu-r7 is a skilled negotiator. s/stdout/stderr/ \ta month ago \tmsfd \tRemove fastlib \t2 months ago \tmsfelfscan \tRemove fastlib \t2 months ago \tmsfencode \tRemove fastlib \t2 months ago \tmsfmachscan \tRemove fastlib \t2 months ago \tmsfpayload \tfixes merge conflicts msfpayload \u0026 exe \ta month ago \tmsfpescan \tRemove fastlib \t2 months ago \tmsfrop \tRemove fastlib \t2 months ago \tmsfrpc \tRemove fastlib \t2 months ago \tmsfrpcd \tRemove call to legacy db.sink queue, closes #4244 \t7 days ago \tmsfupdate \tAlways use maybe_wait_and_exit in msfupdate \ta year ago \tmsfvenom \tFix #4047 - undefined method `rank' due to an invalid encoder name \t19 days ago README.md "},{"date":"2015-01-14T09:57:34Z","kind":"github_poc","ref":"https://github.com/tjjh89017/cve-2014-6332","stars":2,"title":null},{"date":"2016-08-29T17:13:07Z","kind":"github_poc","ref":"https://github.com/mourr/CVE-2014-6332","stars":2,"title":"CVE-2014-6332 ZeroDay POC - Starts PowerShell"},{"date":"2014-11-13","kind":"exploitdb","ref":"35229","stars":null,"title":"Microsoft Internet Explorer 11 - OLE Automation Array Remote Code Execution (1)"},{"date":"2014-11-13","kind":"exploitdb","ref":"35230","stars":null,"title":"Microsoft Internet Explorer \u003c 11 - OLE Automation Array Remote Code Execution (Metasploit)"},{"date":"2014-11-13","kind":"metasploit","ref":"exploit/windows/browser/ms14_064_ole_code_execution","stars":null,"title":"MS14-064 Microsoft Internet Explorer Windows OLE Automation Array Remote Code Execution"},{"date":"2014-11-20","kind":"exploitdb","ref":"35308","stars":null,"title":"Microsoft Internet Explorer OLE Pre-IE11 - Automation Array Remote Code Execution / PowerShell VirtualAlloc (MS14-064)"},{"date":"2015-03-27","kind":"exploitdb","ref":"36516","stars":null,"title":"Acunetix 9.5 - OLE Automation Array Remote Code Execution"}],"tier":"exploited"},"has_fix":null,"headline":"Microsoft Windows Object Linking \u0026 Embedding (OLE) Automation Array Remote Code Execution","id":"CVE-2014-6332","indexable":true,"kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Unknown","product":"Windows","requiredAction":"Apply updates per vendor instructions.","vendorProject":"Microsoft","vulnerabilityName":"Microsoft Windows Object Linking \u0026 Embedding (OLE) Automation Array Remote Code Execution Vulnerability"},"kind":"cve","links":{"ecosystem":null,"product":"microsoft:windows_7","products":["microsoft:windows_7","microsoft:windows_8","microsoft:windows_8.1","microsoft:windows_rt","microsoft:windows_rt_8.1","microsoft:windows_server_2003","microsoft:windows_server_2008","microsoft:windows_server_2012","microsoft:windows_vista"],"type":"memory_corruption","year":"2014"},"n_packages":0,"n_references":16,"next":{"headline":"Code injection in n/a","id":"CVE-2014-6333"},"packages":[],"prev":{"headline":"Security feature bypass in n/a","id":"CVE-2014-6331"},"products":["n/a"],"published":"2014-11-11","related":[{"cvss_score":9.8,"headline":"Microsoft HTTP.sys Remote Code Execution","id":"CVE-2015-1635","kev_date_added":"2022-02-10","published":"2015-04-14"},{"cvss_score":8.8,"headline":"Microsoft Win32k Privilege Escalation","id":"CVE-2015-2360","kev_date_added":"2022-05-25","published":"2015-06-10"},{"cvss_score":8.8,"headline":"Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation","id":"CVE-2014-6324","kev_date_added":"2022-03-25","published":"2014-11-18"},{"cvss_score":8.8,"headline":"Microsoft Windows Remote Code Execution","id":"CVE-2014-4148","kev_date_added":"2022-05-25","published":"2014-10-15"},{"cvss_score":8.8,"headline":"Microsoft Windows Group Policy Preferences Password Privilege Escalation","id":"CVE-2014-1812","kev_date_added":"2021-11-03","published":"2014-05-14"},{"cvss_score":8.8,"headline":"Microsoft Windows Out-of-Bounds Write","id":"CVE-2013-3918","kev_date_added":"2025-10-06","published":"2013-11-12"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"open","licence":"CC0 1.0","name":"CISA KEV"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"BSD-3-Clause","name":"Metasploit"},{"class":"attribution","licence":"GPL-2.0-or-later","name":"Exploit-DB"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"active","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-10-22","vendors":["n/a"]},"summary":"Remote attackers can execute arbitrary code via a crafted website exploiting improper size handling in Windows OLE Automation.","url":"https://insights.sbomify.com/CVE-2014-6332/"}