CVE-2014-4077: Microsoft IME Japanese Privilege Escalation Vulnerability
Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.EXE (aka IME for Japanese) is installed, allow remote attackers to bypass a sandbox protection mechanism via a crafted PDF document, aka "Microsoft IME (Japanese) Elevation of Privilege Vulnerability," as exploited in the wild in 2014.
Other sources
Microsoft Input Method Editor (IME) Japanese is a keyboard with Japanese characters that can be enabled on Windows systems as it is included by default (with the default set as disabled). IME Japanese contains an unspecified vulnerability when IMJPDCT.EXE (IME for Japanese) is installed which allows attackers to bypass a sandbox and perform privilege escalation.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4077?
CVE-2014-4077 has been classified as a critical vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2014-4077?
To fix CVE-2014-4077, apply the latest security updates provided by Microsoft for the affected software.
What are the affected systems for CVE-2014-4077?
CVE-2014-4077 affects Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008, Windows 7 SP1, and Office 2007 SP3.
What type of attack is associated with CVE-2014-4077?
CVE-2014-4077 enables attackers to bypass sandbox protections through specially crafted PDF documents.
Can CVE-2014-4077 be exploited without user interaction?
Yes, CVE-2014-4077 can be exploited remotely without requiring user interaction, increasing its potential risk.