CVE-2014-4114
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8,...
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a "Sandworm" attack in June through October 2014, aka "Windows OLE Remote Code Execution Vulnerability."
Exploit likelihood
What each source reports
CVE List
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a "Sandworm" attack in June through October 2014, aka "Windows OLE Remote Code Execution Vulnerability."
- Record
CVE-2014-4114- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
EUVDEUVD-2014-4045
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a "Sandworm" attack in June through October 2014, aka "Windows OLE Remote Code Execution Vulnerability."
- Record
EUVD-2014-4045- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3hff-6c4j-j2w5
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8,...
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a "Sandworm" attack in June through October 2014, aka "Windows OLE Remote Code Execution Vulnerability."
- Record
GHSA-3hff-6c4j-j2w5- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
CISA KEV No score
Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability
A vulnerability exists in Windows Object Linking & Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object.
- Record
CVE-2014-4114- Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a "Sandworm" attack in June through October 2014, aka "Windows OLE Remote Code Execution Vulnerability."
- Record
CVE-2014-4114- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | MS14-060 Microsoft Windows OLE Package Manager Code Execution | 2014-10-14 |
| Exploit-DB | Microsoft Windows - OLE Package Manager SandWorm | 2014-10-20 |
| Exploit-DB | Microsoft Windows - OLE Package Manager Code Execution (MS14-060) (Metasploit) | 2014-10-20 |
| Exploit-DB | Microsoft Windows - OLE Remote Code Execution 'Sandworm' (MS14-060) | 2014-10-25 |
| Exploit-DB | Microsoft Office 2007/2010 - OLE Arbitrary Command Execution | 2014-11-12 |
| Exploit-DB | Microsoft Windows - OLE Package Manager Code Execution (via Python) (MS14-064) (Metasploit) | 2014-11-14 |
| Exploit-DB | Microsoft Windows - OLE Package Manager Code Execution (MS14-064) (Metasploit) | 2014-11-14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-4114 is a high vulnerability (CVSS 9.3) in Microsoft Windows, published October 15, 2014. CISA lists it as known to be exploited, since March 3, 2022. EUVD reports exploitation since March 3, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 81.6%, the 99th percentile. No source names a fixed version.
References
blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx
isightpartners.com/2014/10/cve-2014-4114
secunia.com/advisories/60972
exploit-db.com/exploits/35055
Show 7 moreShow less
securityfocus.com/bid/70419
blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-windows-zero-day-vulnerability-cve-2014-4114-aka-sandworm
docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-060
osvdb.org/show/osvdb/113140
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-4114
nvd.nist.gov/vuln/detail/CVE-2014-4114
github.com/advisories/GHSA-3hff-6c4j-j2w5