{"id":"CVE-2014-1776","kind":"vulnerability","aliases":["CVE-2014-1776"],"related":[],"title":"Microsoft Internet Explorer: Microsoft Internet Explorer Memory Corruption Vulnerability","description":"Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014.  NOTE: this issue originally emphasized VGX.DLL, but Microsoft clarified that \"VGX.DLL does not contain the vulnerable code leveraged in this exploit. Disabling VGX.DLL is an exploit-specific workaround that provides an immediate, effective workaround to help block known attacks.\"","summary":"Microsoft Internet Explorer has a memory corruption flaw that lets a remote attacker run code as the current user. Attackers are exploiting it in the wild, and CISA lists it in its Known Exploited Vulnerabilities catalog.","severity":"critical","cvss":10.0,"epss":0.82682,"exploited":true,"exploited_at":"2022-01-28T00:00:00+00:00","products":[{"name":"Microsoft Internet Explorer","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","internet-explorer","other","windows"],"not_affected_if":["no-internet-explorer","patched"],"how_to_check":"Check which Internet Explorer version is installed and whether Microsoft's 2014 security update for it is applied; the sources do not give a command.","fix":"Apply Microsoft's update for Internet Explorer per vendor instructions (CISA required action); the sources do not name a fixed version.\nIf the update cannot be applied, stop using Internet Explorer.","status":"open","published_at":"2014-04-27T10:55:03+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:29:02+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T21:29:02Z","model":"claude-haiku-5-5","output":{"fix":"Apply Microsoft's update for Internet Explorer per vendor instructions (CISA required action); the sources do not name a fixed version.\nIf the update cannot be applied, stop using Internet Explorer.","reach":"internet","impact":"high","summary":"Microsoft Internet Explorer has a memory corruption flaw that lets a remote attacker run code as the current user. Attackers are exploiting it in the wild, and CISA lists it in its Known Exploited Vulnerabilities catalog.","category":"other","who_cares":["windows","internet-explorer"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code as the logged-in user after the victim visits a page.","analyst_note":"Confirm the affected IE versions and the exact Microsoft security bulletin/patch from the NVD or Microsoft advisory for CVE-2014-1776.","how_to_check":"Check which Internet Explorer version is installed and whether Microsoft's 2014 security update for it is applied; the sources do not give a command.","needs_analyst":true,"not_affected_if":["no-internet-explorer","patched"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000495,"input_tokens":2834,"output_tokens":424,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1776':12A,15A '-2014':11A,14A '11':72C '2014':103C '6':70C 'allow':73C 'april':102C 'arbitrari':78C 'attack':37B,44B,75C,143C 'block':141C 'catalog':60B 'caus':81C 'cisa':52B 'clarifi':112C 'cmarkup':93C 'code':39B,79C,120C 'contain':117C 'corrupt':8A,31B,87C 'current':42B 'cve':10A,13A 'denial':83C 'disabl':125C 'effect':137C 'emphas':108C 'execut':77C 'exploit':19B,46B,58B,97C,124C,130C 'exploit-specif':129C 'explor':3A,6A,22B,27B,69C 'explorer':18A 'flaw':32B 'free':64C 'function':95C 'help':140C 'immedi':136C 'internet':2A,5A,17A,21B,26B,68C 'internet-explor':20B 'isconnectedtoprimarymarkup':94C 'issu':106C 'known':57B,142C 'let':34B 'leverag':121C 'list':53B 'memori':7A,30B,86C 'microsoft':1A,4A,16A,25B,67C,111C 'note':104C 'origin':107C 'provid':134C 'relat':90C 'remot':36B,74C 'run':38B 'servic':85C 'specif':131C 'use':62C 'use-after-fre':61C 'user':43B 'vector':89C 'vgx.dll':109C,114C,126C 'via':88C 'vulner':9A,59B,65C,119C 'wild':50B,100C 'window':24B 'workaround':132C,138C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2014-04-27T10:55:03+00:00","kev":{"dateAdded":"2022-01-28","dueDate":"2022-07-28","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2014-1776","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-1776","severity":null,"published_at":"2022-01-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T14:39:41+00:00","note":null},{"source":"epss","external_id":"CVE-2014-1776","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-1776","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2014-1776","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1776","severity":null,"published_at":"2014-04-27T10:55:03+00:00","modified_at":"2026-06-17T00:05:32+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}