Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, an…

published 2014-10-22 12 y ago modified 2026-06-17 4 mo ago also EUVD-2014-6236

cvss: 7.8; version 3.1, CNA
cisa kev: Exploited; added 2022-02-25
epss: 77.5%; EPSS 77.5% chance of exploitation in 30 days, percentile 99.5%
public exploits: 8; Metasploit, Exploit-DB

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object, as exploited in the wild in October 2014 with a crafted PowerPoint document.

Patch / fix

cisa required action Apply updates per vendor instructions.

links 3

Timeline

2014-10-20 First public exploit (EDB-35020)
2014-10-22 Published
2014-11-11 0-day patched (Project Zero)
2022-02-25 Added to CISA KEV
2022-08-25 CISA patch deadline
2025-02-10 CISA SSVC: exploitation active

Known exploited

Added: 4 y ago (2022-02-25)
Patch by: 2022-08-25 (4 y ago)
Ransomware: Not known
Required action: Apply updates per vendor instructions.
Vendor, product: Microsoft, Windows
CISA name: Microsoft Windows Code Injection Vulnerability

Zero-day

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Patched: 2014-11-11
Details: project zero tracker

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: total
Assessed: 20 mo ago (2025-02-10)

Exploit prediction

77.48% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/windows/fileformat/ms14_064_packager_python MS14-064 Microsoft Windows OLE Package Manager Code Execution Through Python metasploit exploit, excellent rank, 2014-11-12
Metasploit exploit/windows/fileformat/ms14_064_packager_run_as_admin MS14-064 Microsoft Windows OLE Package Manager Code Execution metasploit exploit, excellent rank, 2014-10-21
EDB-35236 Microsoft Windows - OLE Package Manager Code Execution (MS14-064) (Metasploit) local, 2014-11-14
EDB-35235 Microsoft Windows - OLE Package Manager Code Execution (via Python) (MS14-064) (Metasploit) local, 2014-11-14
EDB-35216 Microsoft Office 2007/2010 - OLE Arbitrary Command Execution local, 2014-11-12
EDB-35055 Microsoft Windows - OLE Remote Code Execution 'Sandworm' (MS14-060) remote, 2014-10-25
EDB-35020 Microsoft Windows - OLE Package Manager Code Execution (MS14-060) (Metasploit) local, 2014-10-20
EDB-35019 Microsoft Windows - OLE Package Manager SandWorm local, 2014-10-20

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	9.3	AV:N/AC:M/Au:N/C:C/I:C/A:C

References

docs.microsoft.com /en-us/security-updates/securitybulletins/2014/ms14-064
vendor-advisory, patch
blogs.technet.com /b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx
broken-link, patch, vendor-advisory
technet.microsoft.com /library/security/3010060
patch, vendor-advisory
exchange.xforce.ibmcloud.com /vulnerabilities/97714
vdb-entry, third-party-advisory
twitter.com /ohjeongwook/statuses/524795124270653440
third-party-advisory
secunia.com /advisories/61803
third-party-advisory, broken-link
securitytracker.com /id/1031097
vdb-entry, broken-link, third-party-advisory
securityfocus.com /bid/70690
vdb-entry, broken-link, third-party-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-6352
government-resource, us-government-resource

Sources

CVE List CVE-2014-6352
NVD CVE-2014-6352

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary