CVE-2014-4114: Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability

CISA Known Exploited Vulnerabilities

Name

Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability

Vendor

Microsoft

Product

Windows

Added to the catalog

2022-03-03

Due date for US federal agencies

2022-03-24

Weaknesses

CWE-20

Catalog version

2026.10.30

A vulnerability exists in Windows Object Linking & Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object.

Required action (CISA)

Apply updates per vendor instructions.

Ransomware use: CISA does not mark known use of this vulnerability in ransomware campaigns.

Links in CISA's notes

• https://nvd.nist.gov/vuln/detail/CVE-2014-4114

Read on 2026-11-02T23:39:54.475Z under licence cisa-kev-cc0@b0067899 from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

NVD analysis

Status

Analyzed

Published

2014-10-15T10:55:07.817

Last modified

2026-06-17T00:09:27.550

Weaknesses

NVD-CWE-noinfo

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a "Sandworm" attack in June through October 2014, aka "Windows OLE Remote Code Execution Vulnerability."

References

• http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-windows-zero-day-vulnerability-cve-2014-4114-aka-sandworm/ (Exploit)
• http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx (Broken Link, Vendor Advisory)
• http://osvdb.org/show/osvdb/113140 (Broken Link)
• http://secunia.com/advisories/60972 (Broken Link)
• http://www.exploit-db.com/exploits/35019 (Exploit, Third Party Advisory, VDB Entry)
• http://www.exploit-db.com/exploits/35020 (Exploit, Third Party Advisory, VDB Entry)
• http://www.exploit-db.com/exploits/35055 (Exploit, Third Party Advisory, VDB Entry)
• http://www.isightpartners.com/2014/10/cve-2014-4114/ (Broken Link)
• http://www.securityfocus.com/bid/70419 (Broken Link, Third Party Advisory, VDB Entry)
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-060 (Patch, Vendor Advisory)
• http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-windows-zero-day-vulnerability-cve-2014-4114-aka-sandworm/ (Exploit)
• http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx (Broken Link, Vendor Advisory)
• http://osvdb.org/show/osvdb/113140 (Broken Link)
• http://secunia.com/advisories/60972 (Broken Link)
• http://www.exploit-db.com/exploits/35019 (Exploit, Third Party Advisory, VDB Entry)
• http://www.exploit-db.com/exploits/35020 (Exploit, Third Party Advisory, VDB Entry)
• http://www.exploit-db.com/exploits/35055 (Exploit, Third Party Advisory, VDB Entry)
• http://www.isightpartners.com/2014/10/cve-2014-4114/ (Broken Link)
• http://www.securityfocus.com/bid/70419 (Broken Link, Third Party Advisory, VDB Entry)
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-060 (Patch, Vendor Advisory)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-4114 (US Government Resource)

This product uses the NVD API but is not endorsed or certified by the NVD.

Read on 2026-11-02T23:41:28.906Z under licence nvd-api-terms-of-use@ff2a5288 from https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2014-4114

CVE record

Assigner

microsoft

State

PUBLISHED

Published

2014-10-15T10:00:00.000Z

Updated

2025-10-22T00:05:35.412Z

Problem types

n/a

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a "Sandworm" attack in June through October 2014, aka "Windows OLE Remote Code Execution Vulnerability."

References

• http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx
• http://www.isightpartners.com/2014/10/cve-2014-4114/
• 60972
• 35055
• 35019
• 35020
• 70419
• http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-windows-zero-day-vulnerability-cve-2014-4114-aka-sandworm/
• MS14-060
• 113140

Read on 2026-11-03T00:25:23.915Z under licence cve-terms-of-use@81bfa2f3 from https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2014/4xxx/CVE-2014-4114.json