Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014. NOTE: this issue originally emphasized VGX.DLL, but Microsoft clarified that "VGX.DLL does not contain the vulnerable code leveraged in this exploit. Disabling VGX.DLL is an exploit-specific workaround that provides an immediate, effective workaround to help block known attacks."
Published 2014-04-27 10:55:03
Updated 2018-10-12 22:06:04
View at NVD,   CVE.org
Vulnerability category: Memory CorruptionExecute codeDenial of service

CVE-2014-1776 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:
Microsoft Internet Explorer Memory Corruption Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user.
Notes:
https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2014/ms14-021?redirectedfrom=MSDN
Added on 2022-01-28 Action due date 2022-07-28

Exploit prediction scoring system (EPSS) score for CVE-2014-1776

Probability of exploitation activity in the next 30 days: 96.77%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 100 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2014-1776

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source
10.0
HIGH AV:N/AC:L/Au:N/C:C/I:C/A:C
10.0
10.0
NIST

CWE ids for CVE-2014-1776

  • Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-1776

Products affected by CVE-2014-1776

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!