Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2014-6332

OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, W

Published
Last modified
published
Listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub

Summary

The affected software is Microsoft Windows, specifically the OLE Automation component (OleAut32.dll) on various Windows client and server releases. An attacker could exploit this flaw by luring a user to a specially crafted website, allowing them to run arbitrary code on the affected computer.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka "Windows OLE Automation Array Remote Code Execution Vulnerability."

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • n/a n/a

    Version range not reported

References 16

Exploit-DB

kb.cert.org

us-cert.gov

docs.microsoft.com

packetstormsecurity.com

securityfocus.com

securitytracker.com

forsec.nl

securityintelligence.com