CVE-2014-0322
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to...
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.
- Record
CVE-2014-0322- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.
- Record
CVE-2014-0322- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2014-0360
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.
- Record
EUVD-2014-0360- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fc9q-h2h8-qq52
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to...
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.
- Record
GHSA-fc9q-h2h8-qq52- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
CISA KEV No score
Microsoft Internet Explorer Use-After-Free Vulnerability
Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code.
- Record
CVE-2014-0322- Weakness
- CWE-416
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free | 2014-02-13 |
| Exploit-DB | Microsoft Internet Explorer 10 - CMarkup Use-After-Free (MS14-012) | 2014-04-14 |
| Exploit-DB | Microsoft Internet Explorer - CMarkup Use-After-Free (MS14-012) (Metasploit) | 2014-04-16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-0322 is a high vulnerability (CVSS 8.8) in Microsoft Internet Explorer, published February 14, 2014. CISA lists it as known to be exploited, since May 4, 2022. EUVD reports exploitation since May 4, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 85.1%, the 99th percentile. No source names a fixed version.
References
fireeye.com/blog/technical/cyber-exploits/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2.html
osvdb.org/103354
exploit-db.com/exploits/32851
technet.microsoft.com/security/advisory/2934088
docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012
kb.cert.org/vuls/id/732479
Show 8 moreShow less
twitter.com/nanoc0re/statuses/434251658344673281
community.websense.com/blogs/securitylabs/archive/2014/02/13/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx
dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0322
nvd.nist.gov/vuln/detail/CVE-2014-0322
github.com/advisories/GHSA-fc9q-h2h8-qq52