CVE-2014-6332: Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability

CVSS: 9.3v2.0HighKEVAnalyzed

Published 11-11-2014Last modified 22-10-2025

Vulnerability summary

CVE-2014-6332 is a high (CVSS 9.3) vulnerability in Microsoft Windows. It is known to be exploited: CISA lists it, first on 25-03-2022. EPSS estimates a 94.92% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 17 public exploits are recorded.

Overall risk

85/100

0100

Critical · default modelHow is this calculated?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

94.92%

0%100%

Critical · -0.08 pp in 30 days

KEVListedCISA

RansomwareNone recordedNo known use recorded

Public exploits17reference, exploit-database, metasploit

Timeline

11-11-2014
PublishedVulnerability first disclosed.
25-03-2022
Added to CISA KEVMicrosoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability
15-04-2022
CISA remediation dueApply updates per vendor instructions.
22-10-2025
Last modifiedVulnerability information updated.

Description

OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka "Windows OLE Automation Array Remote Code Execution Vulnerability."

CVSS metrics

3 scores · 2 sources · 2 versions

v3.18.8v2.09.3

EPSS trend

Probability

94.92%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

-0.08 pp

From 95.00% on 19-09-2026

19-09-202619-10-2026

EPSS score

94.92%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 25-03-2022
Federal due date: 15-04-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2014-6332

Public exploits

17 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown

Show all 17 exploits

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (forsec.nl)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (securityintelligence.com)
Maturity: unknown
exploit-databaseremotewindowsVerified
Acunetix 9.5 - OLE Automation Array Remote Code Execution
Maturity: weaponized
exploit-databaseremotewindowsVerified
Havij - OLE Automation Array Remote Code Execution
Maturity: weaponized
exploit-databaseremotewindowsVerified
HTML Compiler - Remote Code Execution
Maturity: weaponized
exploit-databaseremotewindowsUnverified
Internet Download Manager - OLE Automation Array Remote Code Execution
Maturity: poc
exploit-databaseremotewindowsVerified
Microsoft Internet Explorer 11 - OLE Automation Array Remote Code Execution (1)
Maturity: weaponized
exploit-databaseremotewindowsUnverified
Microsoft Internet Explorer < 11 - OLE Automation Array Remote Code Execution (Metasploit)
Maturity: poc
exploit-databaseremotewindowsVerified
Microsoft Internet Explorer OLE Pre-IE11 - Automation Array Remote Code Execution / PowerShell VirtualAlloc (MS14-064)
Maturity: weaponized
exploit-databaseremotewindowsVerified
Microsoft Windows HTA (HTML Application) - Remote Code Execution (MS14-064)
Maturity: weaponized
exploit-databaseremotewindowsVerified
The World Browser 3.0 Final - Remote Code Execution
Maturity: weaponized
MetasploitremoteVerified
MS14-064 Microsoft Internet Explorer Windows OLE Automation Array Remote Code Execution
exploit/windows/browser/ms14_064_ole_code_execution
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Microsoft9 products

Show all 9

1 vendor · 9 products

References

17 links

www.exploit-db.com/exploits/37668/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.exploit-db.com/exploits/37800/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.kb.cert.org/vuls/id/158647Third Party AdvisoryX Refsource CERT VNUS Government Resource
www.exploit-db.com/exploits/38512/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.us-cert.gov/ncas/alerts/TA14-318BThird Party AdvisoryX Refsource CERTUS Government Resource
docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-064Vendor AdvisoryX Refsource MSPatch
packetstormsecurity.com/files/134062/HTML-Compiler-Remote-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
www.securityfocus.com/bid/70952VDB EntryX Refsource BIDThird Party Advisory
packetstormsecurity.com/files/134064/Microsoft-Compiled-HTML-Help-Remote-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/134053/Avant-Browser-Lite-Ultimate-Remote-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry

Show all 17 references

www.securitytracker.com/id/1031184VDB EntryX Refsource SECTRACKThird Party Advisory
packetstormsecurity.com/files/134061/The-World-Browser-3.0-Final-Remote-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
forsec.nl/wp-content/uploads/2014/11/ms14_064_ie_olerce.rb_.txtX Refsource MISCExploitThird Party Advisory
packetstormsecurity.com/files/134079/Winamp-Bento-Browser-Remote-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
securityintelligence.com/ibm-x-force-researcher-finds-significant-vulnerability-in-microsoft-windowsX Refsource MISCExploitThird Party Advisory
www.exploit-db.com/exploits/38500/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-6332Government ResourceUS Government Resource

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities