---
id: "CVE-2014-6332"
kind: "vulnerability"
aliases: ["CVE-2014-6332"]
title: "Microsoft Windows: Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability"
severity: "critical"
cvss: 9.3
epss: 0.94918
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Windows", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Windows (Vista SP2, 7 SP1, 8, 8.1, RT, Server 2003 SP2, 2008, 2008 R2, 2012, 2012 R2)", "fixed": ["KB3006226 (MS14-064)"], "affected": "all supported editions at Nov 2014 without KB3006226", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "internet-explorer", "internet-facing-browsing-hosts", "ole", "windows"]
not_affected_if: ["fully-patched-windows", "no-ie-browsing", "patched-kb3006226"]
published_at: "2014-11-11T22:55:05+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-6332", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2014-6332", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:23:34+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6332", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft Windows: Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability

OLE Automation array flaw (OleAut32, 'Windows OLE Automation Array RCE', a.k.a. VBScript/IE 'Godmode' bug). An attacker's web page opened in Internet Explorer runs code as the current user. Affects all supported Windows at the time, Vista SP2 to 8.1, Server 2003 to 2012 R2, RT. In CISA KEV. Microsoft's bulletin has no workaround.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Windows affected ? fixed ?
- vendor:Windows (Vista SP2, 7 SP1, 8, 8.1, RT, Server 2003 SP2, 2008, 2008 R2, 2012, 2012 R2) affected all supported editions at Nov 2014 without KB3006226 fixed KB3006226 (MS14-064)

## How to check

Check that KB3006226 is installed: run 'wmic qfe get HotFixID | findstr 3006226' or 'Get-HotFix -Id KB3006226' in PowerShell. Missing means exposed. Servers and workstations that browse with Internet Explorer are most at risk. Any Windows still unpatched or out of support (e.g. Server 2003, Vista) is exposed.

## Fix

Install the MS14-064 update KB3006226 (CVE-2014-6332), and KB3010788 for the sibling CVE-2014-6352. Windows RT and RT 8.1 get it via Windows Update only. Best fix: move off unsupported Windows and stop using Internet Explorer. Microsoft gives no workaround for 6332.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-6332
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2014-6332
- 2026-10-23T21:23:34+00:00 analyst — Read MS14-064 bulletin (primary). Fix is KB3006226 for CVE-2014-6332; KB3010788 is the separate CVE-2014-6352 fix. KEV page linked but not read in detail. No PoC link verified. Bulletin said not exploited at release; KEV later lists it as exploited.
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2014-6332

## Documents

- [advisory] Microsoft Security Bulletin MS14-064 https://learn.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-064
- [mentions] CISA KEV entry CVE-2014-6332 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-6332

## From the sources

OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka "Windows OLE Automation Array Remote Code Execution Vulnerability."

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_