{"id":"CVE-2014-6332","kind":"vulnerability","aliases":["CVE-2014-6332"],"related":[],"title":"Microsoft Windows: Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability","description":"OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka \"Windows OLE Automation Array Remote Code Execution Vulnerability.\"","summary":"OLE Automation array flaw (OleAut32, 'Windows OLE Automation Array RCE', a.k.a. VBScript/IE 'Godmode' bug). An attacker's web page opened in Internet Explorer runs code as the current user. Affects all supported Windows at the time, Vista SP2 to 8.1, Server 2003 to 2012 R2, RT. In CISA KEV. Microsoft's bulletin has no workaround.","severity":"critical","cvss":9.3,"epss":0.94918,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows (Vista SP2, 7 SP1, 8, 8.1, RT, Server 2003 SP2, 2008, 2008 R2, 2012, 2012 R2)","fixed":["KB3006226 (MS14-064)"],"affected":"all supported editions at Nov 2014 without KB3006226","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","internet-explorer","internet-facing-browsing-hosts","ole","windows"],"not_affected_if":["fully-patched-windows","no-ie-browsing","patched-kb3006226"],"how_to_check":"Check that KB3006226 is installed: run 'wmic qfe get HotFixID | findstr 3006226' or 'Get-HotFix -Id KB3006226' in PowerShell. Missing means exposed. Servers and workstations that browse with Internet Explorer are most at risk. Any Windows still unpatched or out of support (e.g. Server 2003, Vista) is exposed.","fix":"Install the MS14-064 update KB3006226 (CVE-2014-6332), and KB3010788 for the sibling CVE-2014-6352. Windows RT and RT 8.1 get it via Windows Update only. Best fix: move off unsupported Windows and stop using Internet Explorer. Microsoft gives no workaround for 6332.","status":"open","published_at":"2014-11-11T22:55:05+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:21:55+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T21:21:55Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2014-6332 per vendor instructions (CISA required action: apply updates per vendor instructions). Exact patch KB numbers are not stated in the sources.","reach":"internet","impact":"high","summary":"A flaw in OleAut32.dll, the OLE Automation library in Windows, lets a remote attacker run code on a Windows machine by getting a user to load a crafted web page. It is listed in CISA's Known Exploited Vulnerabilities catalog, meaning attacks have been observed in the wild.","category":"infrastructure","who_cares":["windows","internet-facing-browsing-hosts"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs code on the Windows machine when a user visits a malicious site.","analyst_note":"Confirm the exact patch identifiers and affected Windows versions from Microsoft's security bulletin MS14-064 and the CISA KEV entry; the sources give no version list or check method.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["fully-patched-windows"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000495,"input_tokens":2841,"output_tokens":421,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the exact patch identifiers and affected Windows versions from Microsoft's security bulletin MS14-064 and the CISA KEV entry; the sources give no version list or check method.","search":"'-2014':16A,19A '-6332':17A,20A '2003':32A,93B,114C '2008':34A,35A,121C '2012':37A,38A,95B,135C '7':26A,127C '8':28A,130C '8.1':29A,91B,132C,144C 'a.k.a':62B 'affect':81B 'aka':177C 'allow':145C 'arbitrari':150C 'array':10A,54B,60B,162C,181C 'array-redimens':161C 'attack':67B,147C 'attempt':164C 'autom':9A,53B,59B,180C 'brows':48B 'bug':65B 'bulletin':103B 'cisa':99B 'code':12A,76B,151C,183C 'craft':154C 'current':79B 'cve':15A,18A 'demonstr':158C 'embed':7A 'execut':13A,149C,184C 'exploit':40B 'explor':44B,74B 'face':47B 'flaw':55B 'function':176C 'godmod':64B 'gold':136C,142C 'handl':168C 'host':49B 'improp':167C 'infrastructur':41B 'internet':43B,46B,73B 'internet-explor':42B 'internet-facing-browsing-host':45B 'kev':100B 'link':6A 'microsoft':1A,3A,21A,101B,111C 'object':5A 'ole':8A,50B,52B,58B,109C,179C 'oleaut32':56B 'oleaut32.dll':107C 'open':71B 'page':70B 'r2':36A,39A,96B,124C,138C 'rce':61B 'redimens':163C 'remot':11A,146C,182C 'rt':30A,97B,141C 'run':75B 'safearraydimen':175C 'server':31A,92B,113C,120C,134C 'site':156C 'size':171C 'sp1':27A,125C,128C 'sp2':25A,33A,89B,115C,118C,122C 'support':83B 'time':87B 'trigger':166C 'user':80B 'valu':172C 'vbscript/ie':63B 'via':152C 'vista':24A,88B,117C 'vulner':14A,185C 'web':69B,155C 'window':2A,4A,51B,57B,84B,112C,116C,119C,126C,129C,131C,133C,140C,178C 'windows':22A,23A 'workaround':106B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2014-11-11T22:55:05+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2014-6332","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-6332","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2014-6332","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-6332","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2014-6332:68","url":null,"severity":null,"published_at":"2026-10-23T21:23:34+00:00","modified_at":"2026-10-23T21:23:34+00:00","first_seen_at":"2026-10-23T21:23:34+00:00","fetched_at":"2026-10-23T21:23:34+00:00","note":"Read MS14-064 bulletin (primary). Fix is KB3006226 for CVE-2014-6332; KB3010788 is the separate CVE-2014-6352 fix. KEV page linked but not read in detail. No PoC link verified. Bulletin said not exploited at release; KEV later lists it as exploited."},{"source":"nvd","external_id":"CVE-2014-6332","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6332","severity":null,"published_at":"2014-11-11T22:55:05+00:00","modified_at":"2026-06-17T00:12:55+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":967,"url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-064","title":"Microsoft Security Bulletin MS14-064","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":968,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-6332","title":"CISA KEV entry CVE-2014-6332","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}