CVE-2014-4113

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2,...

7.2 HighIn KEVPublic exploit

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, as exploited in the wild in October 2014, aka "Win32k.sys Elevation of Privilege Vulnerability."

Exploit likelihood

86.6%Up 81.0 points since Feb 4, 2022

What each source reports

CVE List 7.8

Record: CVE-2014-4113
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2014-4044 7.8

Record: EUVD-2014-4044
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-wjjh-xg7v-8wf9 7.8

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2,...

Record: GHSA-wjjh-xg7v-8wf9
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

CISA KEV No score

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.

Record: CVE-2014-4113
Weakness: CWE-264
Updated: 2026-11-02

NVD 7.8

Record: CVE-2014-4113
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Windows TrackPopupMenu Win32k NULL Pointer Dereference	2014-10-14
Exploit-DB	Microsoft Windows - TrackPopupMenu Win32k Null Pointer Dereference (MS14-058) (Metasploit)	2014-10-28
PoC in GitHub	johnjohnsp1/CVE-2014-4113	2014-11-19
Exploit-DB	Microsoft Windows 8.1/ Server 2012 - 'Win32k.sys' Local Privilege Escalation (MS14-058)	2014-11-24
Exploit-DB	Microsoft Windows 8.0/8.1 (x64) - 'TrackPopupMenu' Local Privilege Escalation (MS14-058)	2015-05-19
Metasploit	Windows Net-NTLMv2 Reflection DCOM/RPC	2016-01-16
Metasploit	Windows Net-NTLMv2 Reflection DCOM/RPC (Juicy)	2016-01-16
PoC in GitHub	nsxz/Exploit-CVE-2014-4113	2016-01-22
PoC in GitHub	sam-b/CVE-2014-4113	2016-02-07
Exploit-DB	Microsoft Windows Kernel - 'win32k.sys' Local Privilege Escalation (MS14-058)	2016-04-05
PoC in GitHub	wikiZ/cve-2014-4113	2020-11-30

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-4113 is a high vulnerability (CVSS 7.2) in Microsoft Win32k, published October 15, 2014. CISA lists it as known to be exploited, since May 4, 2022. EUVD reports exploitation since May 4, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 86.6%, the 99th percentile. No source names a fixed version.

References

Show 8 moreShow less