CVE-2014-4114: Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a "Sandworm" attack in June through October 2014, aka "Windows OLE Remote Code Execution Vulnerability."
Other sources
A vulnerability exists in Windows Object Linking & Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object.
— CISA
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4114?
CVE-2014-4114 has a critical severity rating due to its potential for remote code execution.
How do I fix CVE-2014-4114?
To fix CVE-2014-4114, you should install the latest security updates provided by Microsoft for the affected Windows versions.
Which systems are affected by CVE-2014-4114?
CVE-2014-4114 affects multiple Microsoft systems including Windows Vista, 7, 8, 8.1, Server 2008, and 2012.
What type of attack does CVE-2014-4114 enable?
CVE-2014-4114 allows remote attackers to execute arbitrary code through crafted OLE objects in Office documents.
What should I do if I believe my system is vulnerable to CVE-2014-4114?
If you suspect that your system is vulnerable to CVE-2014-4114, you should immediately apply the recommended security updates and conduct a security assessment.