Actively exploited · CISA KEV · NVD published 2014-10-15
Actively exploitedCVE-2014-4114
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a "Sandworm" attack in June through October 2014, aka "Windows OLE Remote Code Execution Vulnerability."
- First PoC
- 3897 days →Metasploit
- 484 days →First cited attacker
Signals
- Exploited in the wild
- Yesadded 2022-03-03 · due 2022-03-24. An observation, not a forecast.
- EPSS · 30-day forecast
- 82%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
- CVSS · NVD · HIGH
- 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Internet exposure
- not stated by sourcesNo exposure census on this CVE's dispatches.
Exploits
7 known · links onlyMetasploit1
This module exploits a vulnerability found in Windows Object Linking and Embedding (OLE) allowing arbitrary code execution, publicly known as "Sandworm". Platforms such as Windows Vista SP2 all the way to Windows 8, Windows Server 2008 and 2012 are known to be vulnerable. However, based on our testing, the most reliable setup is on Windows platforms running Office 2013 and Office 2010 SP2. And please keep in mind that some other setups such as us
ruby · seen 2026-10-18
Exploit-DB6
created 2014-10-20
created 2014-10-20
created 2014-10-25
created 2014-11-12
created 2014-11-14
created 2014-11-14
On the wire
0 dispatchesNo dispatch on our wire has named this CVE yet.
Watch this one?
KEV additions reach Telegram and the KEV-only RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.