CVE-2014-1776

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 82,7%

Kerentanan Use After Free pada microsoft internet explorer. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP. Masuk katalog KEV CISA pada 28 Januari 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014. NOTE: this issue originally emphasized VGX.DLL, but Microsoft clarified that "VGX.DLL does not contain the vulnerable code leveraged in this exploit. Disabling VGX.DLL is an exploit-specific workaround that provides an immediate, effective workaround to help block known attacks."

Rincian

Terbit di NVD

27 April 2014

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

82,7% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Microsoft Internet Explorer Memory Corruption Vulnerability

Masuk KEV

28 Januari 2022

Tenggat CISA

28 Juli 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-021 patch · advisory vendor
• https://technet.microsoft.com/library/security/2963983 mitigasi · patch · advisory vendor
• http://blogs.technet.com/b/srd/archive/2014/04/30/protection-strategies-for-the-security-advisory-2963983-ie-0... broken link · mitigasi
• http://www.kb.cert.org/vuls/id/222929 mitigasi · advisory pihak ketiga · pemerintah AS
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-1776 pemerintah AS
• http://securitytracker.com/id?1030154 broken link · advisory pihak ketiga · vdb entry
• http://www.securityfocus.com/bid/67075 broken link · advisory pihak ketiga · vdb entry
• http://www.signalsec.com/cve-2014-1776-ie-0day-analysis/ exploit · advisory pihak ketiga
• https://www.vicarius.io/vsociety/posts/cve-2014-1776-use-after-free-vulnerability-in-microsoft-internet-explor... advisory pihak ketiga
• https://www.vicarius.io/vsociety/posts/cve-2014-1776-use-after-free-vulnerability-in-microsoft-internet-explor... advisory pihak ketiga
• http://secunia.com/advisories/57908 broken link
• http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-... broken link
• http://www.osvdb.org/106311 broken link