CVE-2014-4113
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2,...
CVE-2014-4113 is a high vulnerability (CVSS 7.2) in Microsoft Win32k, published October 15, 2014. CISA lists it as known to be exploited, since May 4, 2022. EUVD reports exploitation since May 4, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 86.6%, the 99th percentile. No source names a fixed version.
- Severity
- 7.2 HighCVSS 2.0, NVD
- Exploit chance
- 86.6%EPSS, 99th percentile
- Exploitation
- ExploitedCISA KEV,
- Fixed in
- No fix listedNo source names one
Description
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, as exploited in the wild in October 2014, aka "Win32k.sys Elevation of Privilege Vulnerability."
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Windows TrackPopupMenu Win32k NULL Pointer Dereference | 2014-10-14 |
| Exploit-DB | Microsoft Windows - TrackPopupMenu Win32k Null Pointer Dereference (MS14-058) (Metasploit) | 2014-10-28 |
| PoC in GitHub | johnjohnsp1/CVE-2014-4113 | 2014-11-19 |
| Exploit-DB | Microsoft Windows 8.1/ Server 2012 - 'Win32k.sys' Local Privilege Escalation (MS14-058) | 2014-11-24 |
| Exploit-DB | Microsoft Windows 8.0/8.1 (x64) - 'TrackPopupMenu' Local Privilege Escalation (MS14-058) | 2015-05-19 |
| Metasploit | Windows Net-NTLMv2 Reflection DCOM/RPC | 2016-01-16 |
| Metasploit | Windows Net-NTLMv2 Reflection DCOM/RPC (Juicy) | 2016-01-16 |
| PoC in GitHub | nsxz/Exploit-CVE-2014-4113 | 2016-01-22 |
| PoC in GitHub | sam-b/CVE-2014-4113 | 2016-02-07 |
| Exploit-DB | Microsoft Windows Kernel - 'win32k.sys' Local Privilege Escalation (MS14-058) | 2016-04-05 |
| PoC in GitHub | wikiZ/cve-2014-4113 | 2020-11-30 |
What each source reports
CVE List
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, as exploited in the wild in October 2014, aka "Win32k.sys Elevation of Privilege Vulnerability."
- Record
CVE-2014-4113- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
EUVDEUVD-2014-4044
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, as exploited in the wild in October 2014, aka "Win32k.sys Elevation of Privilege Vulnerability."
- Record
EUVD-2014-4044- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wjjh-xg7v-8wf9
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2,...
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, as exploited in the wild in October 2014, aka "Win32k.sys Elevation of Privilege Vulnerability."
- Record
GHSA-wjjh-xg7v-8wf9- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
CISA KEVNo score
Microsoft Win32k Privilege Escalation Vulnerability
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
- Record
CVE-2014-4113- Weakness
- CWE-264
- Updated
- 2026-11-02
NVD
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, as exploited in the wild in October 2014, aka "Win32k.sys Elevation of Privilege Vulnerability."
- Record
CVE-2014-4113- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx
packetstormsecurity.com/files/131964/Windows-8.0-8.1-x64-TrackPopupMenu-Privilege-Escalation.html
secunia.com/advisories/60970
exploit-db.com/exploits/37064
securityfocus.com/bid/70364
osvdb.org/show/osvdb/113167
Show 8 moreShow less
docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-058
github.com/sam-b/CVE-2014-4113
blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-a-windows-kernel-mode-vulnerability-cve-2014-4113
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-4113
nvd.nist.gov/vuln/detail/CVE-2014-4113