CVE-2014-6317: microsoft windows_7 Improper Validation of Array Index

Vulnerability summary

CVE-2014-6317 is a high (CVSS 7.1) Improper Validation of Array Index vulnerability in microsoft windows_7. EPSS estimates a 18.43% chance of exploitation in the next 30 days, higher than 97.2% of scored vulnerabilities.

Timeline

1. 11-11-2014
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Array index error in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to cause a denial of service (reboot) via a crafted TrueType font, aka "Denial of Service in Windows Kernel Mode Driver Vulnerability."

• CWE-129Improper Validation of Array IndexThe product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.