Microsoft Windows: Remote Code Execution (CVE-2014-6332)

What is affected, what to do

OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka "Windows OLE Automation Array Remote Code Execution Vulnerability."

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft Windows Server 2008 eq r2..r2
• Microsoft Windows Server 2012 eq r2..r2

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Deploy Microsoft bulletin MS14-064 (KB3011443) across every affected Windows build — in particular workstations still running Internet Explorer and legacy hosts (Windows 7/8/8.1, Server 2003/2008/2008 R2/2012). Windows Server 2003 and Vista no longer receive updates outside Extended Security Updates; treat them as unpatchable.
   • Isolate any legacy host that cannot be patched into a dedicated VLAN without internet egress and without access to mail gateways or user browsing paths.
   • Disable Internet Explorer organisation-wide via GPO or restrict it to defined intranet zones; move the default browser to a current Chromium/Firefox build.
   • Enable EMET or Exploit Guard (ASR) on remaining legacy clients and disable VBScript in the IE Internet Zone (URLAction 1400 set to "Disable" in Zone 3; restrict ActiveX install via FEATURE_RESTRICT_ACTIVEXINSTALL).
   • Block Office macros and OLE object embedding in Office documents via GPO — the exploit also fires from embedded HTML/VBScript payloads carried inside Office files.
2. 02

   Runbook step 2

   Mitigation layers

   • Network: force all legacy clients through a TLS-inspecting web proxy; block known exploit-kit signatures historically weaponising CVE-2014-6332 (Angler, RIG, Neutrino) and obfuscated VBScript payloads in HTTP response bodies.
   • Perimeter/IPS: enable Suricata/Snort coverage for the SafeArrayDimen payload shape (pattern match on redim preserve, runmumaa, CollectGarbage() sequences in HTML responses); ET signatures 2019714 and successors.
   • Endpoint: AppLocker/WDAC rule blocking wscript.exe, cscript.exe and mshta.exe as children of iexplore.exe, winword.exe, excel.exe, powerpnt.exe. EDR rule: block when iexplore.exe drops and executes a PE from %TEMP%.
   • IAM: no local admin on workstations; browser sessions under dedicated low-integrity accounts; restrict Kerberos delegation on file servers to slow post-RCE lateral movement.
   • Configuration: set the ActiveX kill-bit for the affected OleAut32 automation class via registry (HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility) if the patch has to be rolled back. Disable SMBv1 and other legacy protocols on the same hosts — follow-on stages typically depend on them.
   • Deploy Remote Browser Isolation (RBI) or terminal-server-based browsing for users who must keep legacy software for operational reasons.
3. 03

   Runbook step 3

   Detection rules

   • Sysmon EID 1 (Process Create): iexplore.exe spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe or rundll32.exe — classic post-exploitation chain after OLE RCE.
   • Sysmon EID 11 (File Create) plus EID 7 (Image Load): new PE files written to %LOCALAPPDATA%\Temp or %APPDATA% by iexplore.exe or Office processes, followed by load of unusual DLLs.
   • Web proxy / Zeek HTTP log: text/html responses that simultaneously contain VBScript, redim preserve, CreateObject("Wscript.Shell") and obfuscated hex blobs — Sigma shape: selection: c-mime contains "text/html" and c-body contains all ("redim preserve","CreateObject").
   • Windows Security EID 4688 / EDR telemetry: unexpected child processes of Office applications correlated with OLE object activation (packager.dll, ole32.dll image loads).
   • KQL example (Defender/Sentinel): DeviceProcessEvents | where InitiatingProcessFileName in~ ("iexplore.exe","winword.exe","excel.exe") | where FileName in~ ("powershell.exe","wscript.exe","cscript.exe","mshta.exe","cmd.exe") | project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka "Windows OLE Automation Array Remote Code Execution Vulnerability."

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Microsoft Microsoft Windows 7
• Microsoft Microsoft Windows 8 Professional Edition
• Microsoft Microsoft Windows 8.1
• Microsoft Microsoft Windows RT Gold
• Microsoft Microsoft Windows RT 8.1
• Microsoft Microsoft Windows Server 2003
• Microsoft Microsoft Windows Server 2008
• Microsoft Microsoft Windows Server 2012
• Microsoft Microsoft Windows Vista Gold on X64

Weakness classes (CWE)

• CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer

  Class

  The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

  Entry at MITRE CWE-119

References & sources

• exploit-db.com37668Exploit, x_refsource_EXPLOIT-DB, Exploit, Third-party advisory, Vulnerability database
• exploit-db.com37800Exploit, x_refsource_EXPLOIT-DB, Exploit, Third-party advisory, Vulnerability database
• kb.cert.orgVU#158647Third-party advisory, x_refsource_CERT-VN, Third-party advisory, US government resource
• exploit-db.com38512Exploit, x_refsource_EXPLOIT-DB, Exploit, Third-party advisory, Vulnerability database
• us-cert.govTA14-318BThird-party advisory, x_refsource_CERT, Third-party advisory, US government resource
• docs.microsoft.comMS14-064Vendor advisory, x_refsource_MS, Patch, Vendor advisory
• packetstormsecurity.comfiles/134062/HTML-Compiler-Remote-Code-Execution.htmlx_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• securityfocus.com70952Vulnerability database, x_refsource_BID, Third-party advisory, Vulnerability database
• packetstormsecurity.comfiles/134064/Microsoft-Compiled-HTML-Help-Remote-Code-Execution…x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• packetstormsecurity.comfiles/134053/Avant-Browser-Lite-Ultimate-Remote-Code-Execution.…x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• securitytracker.com1031184Vulnerability database, x_refsource_SECTRACK, Third-party advisory, Vulnerability database
• packetstormsecurity.comfiles/134061/The-World-Browser-3.0-Final-Remote-Code-Execution.…x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• forsec.nlwp-content/uploads/2014/11/ms14_064_ie_olerce.rb_.txtx_refsource_MISC, Exploit, Third-party advisory
• packetstormsecurity.comfiles/134079/Winamp-Bento-Browser-Remote-Code-Execution.htmlx_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• securityintelligence.comibm-x-force-researcher-finds-significant-vulnerability-in-micro…x_refsource_MISC, Exploit, Third-party advisory
• exploit-db.com38500Exploit, x_refsource_EXPLOIT-DB, Exploit, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2014-6332government-resource, US government resource