CVE-2014-6332
Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply updates per vendor instructions.
CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2014-6332
Description
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka "Windows OLE Automation Array Remote Code Execution Vulnerability."
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitation Context
as of October 13, 2026- CISA added CVE-2014-6332 to the KEV catalog 2,691 days after its CVE record was published.
- It is one of 390 Microsoft entries in the CISA KEV catalog, and one of 166 added in 2022.
- Its current EPSS score (94.9%) is higher than that of 78% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| - | - | n/a |
References
16 Links- http://packetstormsecurity.com/files/134062/HTML-Compiler-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/134064/Microsoft-Compiled-HTML-Help-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/134053/Avant-Browser-Lite-Ultimate-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/134061/The-World-Browser-3.0-Final-Remote-Code-Execution.html
- https://forsec.nl/wp-content/uploads/2014/11/ms14_064_ie_olerce.rb_.txt
- http://packetstormsecurity.com/files/134079/Winamp-Bento-Browser-Remote-Code-Execution.html
- http://securityintelligence.com/ibm-x-force-researcher-finds-significant-vulnerability-in-microsoft-windows
Record Details
More from Microsoft
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
Windows Print Spooler Remote Code Execution Vulnerability
Internet Shortcut Files Security Feature Bypass Vulnerability
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.