CVE-2014-0322
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to...
CVE-2014-0322 is a high vulnerability (CVSS 8.8) in Microsoft Internet Explorer, published February 14, 2014. CISA lists it as known to be exploited, since May 4, 2022. EUVD reports exploitation since May 4, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 85.1%, the 99th percentile. No source names a fixed version.
- Severity
- 8.8 HighCVSS 3.1, NVD
- Exploit chance
- 85.1%EPSS, 99th percentile
- Exploitation
- ExploitedCISA KEV,
- Fixed in
- No fix listedNo source names one
Description
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free | 2014-02-13 |
| Exploit-DB | Microsoft Internet Explorer 10 - CMarkup Use-After-Free (MS14-012) | 2014-04-14 |
| Exploit-DB | Microsoft Internet Explorer - CMarkup Use-After-Free (MS14-012) (Metasploit) | 2014-04-16 |
What each source reports
NVD Score used
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.
- Record
CVE-2014-0322- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.
- Record
CVE-2014-0322- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2014-0360
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.
- Record
EUVD-2014-0360- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fc9q-h2h8-qq52
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to...
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.
- Record
GHSA-fc9q-h2h8-qq52- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
CISA KEVNo score
Microsoft Internet Explorer Use-After-Free Vulnerability
Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code.
- Record
CVE-2014-0322- Weakness
- CWE-416
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
fireeye.com/blog/technical/cyber-exploits/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2.html
osvdb.org/103354
exploit-db.com/exploits/32851
technet.microsoft.com/security/advisory/2934088
docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012
kb.cert.org/vuls/id/732479
Show 8 moreShow less
twitter.com/nanoc0re/statuses/434251658344673281
community.websense.com/blogs/securitylabs/archive/2014/02/13/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx
dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0322
nvd.nist.gov/vuln/detail/CVE-2014-0322
github.com/advisories/GHSA-fc9q-h2h8-qq52