{"id":"CVE-2014-0322","published":"2014-02-14T16:55:07Z","modified":"2026-06-17T00:02:47Z","title":"Microsoft Internet Explorer Use-After-Free Vulnerability","vendor":"Microsoft","product":"Internet Explorer","tier":"core","eol":{"product":"Internet Explorer","since":"2022-06-15","note":"No security updates; remove it."},"description":{"text":"Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.","provenance":"source","from":"NVD"},"summary":{"text":"Sentence 1: Microsoft Internet Explorer 9 and 10 contain a use-after-free flaw in the browser's markup handling, involving CMarkup and the onpropertychange attribute of script elements. Sentence 2: A remote attacker can execute arbitrary code by getting a user to load a page containing crafted JavaScript, with no authentication required but user interaction needed to trigger it.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:00:28Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.85122,"percentile":0.99712,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-05-04","dueDate":"2022-05-25","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-0322","provenance":"source"},"vulncheckKev":{"dateAdded":"2014-02-14","exploitedFirstSeen":"2014-02-14","ransomware":false,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0322","date":"2014-02-14"},{"url":"https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/2014.07.11.Pitty_Tiger/Pitty_Tiger_Final_Report.pdf","date":"2014-07-11"},{"url":"https://blog.talosintelligence.com/2014/10/threat-spotlight-group-72.html","date":"2014-10-14"},{"url":"https://blogs.cisco.com/security/talos/opening-zxshell","date":"2014-10-28"},{"url":"https://www.bleepingcomputer.com/news/security/us-arrests-chinese-man-involved-with-sakula-malware-used-in-opm-and-anthem-hacks/","date":"2014-11-24"},{"url":"https://www.crowdstrike.com/blog/ironman-deep-panda-uses-sakula-malware-target-organizations-multiple-sectors/","date":"2014-11-24"},{"url":"https://cyberwarzone.com/wp-content/uploads/2019/02/ReportGlobalThreatIntelligence.pdf","date":"2015-02-06"},{"url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf","date":"2016-02-23"},{"url":"https://cisa.gov/news-events/alerts/2015/04/29/top-30-targeted-high-risk-vulnerabilities","date":"2016-09-29"},{"url":"https://www.us-cert.gov/ncas/alerts/TA15-119A","date":"2016-09-29"}],"evidenceTotal":12,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"references":[{"url":"http://community.websense.com/blogs/securitylabs/archive/2014/02/13/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx","tags":["Broken Link","Permissions Required"]},{"url":"http://technet.microsoft.com/security/advisory/2934088","tags":["Patch","Vendor Advisory"]},{"url":"http://twitter.com/nanoc0re/statuses/434251658344673281","tags":["Press/Media Coverage"]},{"url":"http://www.exploit-db.com/exploits/32851","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.exploit-db.com/exploits/32904","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2.html","tags":["Broken Link"]},{"url":"http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html","tags":["Broken Link"]},{"url":"http://www.kb.cert.org/vuls/id/732479","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.osvdb.org/103354","tags":["Broken Link"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012","tags":["Patch","Vendor Advisory"]},{"url":"https://www.dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip","tags":["Broken Link","Exploit"]},{"url":"http://community.websense.com/blogs/securitylabs/archive/2014/02/13/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx","tags":["Broken Link","Permissions Required"]},{"url":"http://technet.microsoft.com/security/advisory/2934088","tags":["Patch","Vendor Advisory"]},{"url":"http://twitter.com/nanoc0re/statuses/434251658344673281","tags":["Press/Media Coverage"]},{"url":"http://www.exploit-db.com/exploits/32851","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.exploit-db.com/exploits/32904","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2.html","tags":["Broken Link"]},{"url":"http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html","tags":["Broken Link"]},{"url":"http://www.kb.cert.org/vuls/id/732479","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.osvdb.org/103354","tags":["Broken Link"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012","tags":["Patch","Vendor Advisory"]},{"url":"https://www.dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip","tags":["Broken Link","Exploit"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0322","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: drive-by via crafted JavaScript in browser","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code","start":69,"end":164}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary code execution achieved","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code","start":69,"end":118}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-a7dfc4dbf8b0acd1f56a","title":"Threat Spotlight: Group 72, Opening the ZxShell","publisher":"blogs.cisco.com","url":"https://blogs.cisco.com/security/talos/opening-zxshell","date":"2014-10-28","mentions":[{"quote":"ZxShell has been observed to be distributed through phishing attacks, dropped by exploits that leverage vulnerabilities such as CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322.","start":3357,"end":3533}]},{"id":"SRC-bd66404e0d19e11c07fa","title":"Operation Dust Storm","publisher":"s7d2.scene7.com","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf","date":null,"mentions":[{"quote":"zero-day, CVE-2014-0322, to a number of unsuspecting","start":14122,"end":14174},{"quote":"executable common to other CVE-2014-0322 attacks,","start":14555,"end":14604}]},{"id":"SRC-619721166ae9d9d7fdcd","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf","date":null,"mentions":[{"quote":"CVE-2014-0322","start":95535,"end":95548},{"quote":"47, 49\r\nCVE-2010-2568, 40, 43, 50\r\nCVE-2010-3336, 52\r\nCVE-2011-1823, 50, 51\r\nCVE-2011-3874, 50, 51\r\nCVE-2012-0158, 52\r\nCVE-2012-0507, 47, 49\r\nCVE-2012-1723, 47, 48, 49\r\nCVE-2012-1889, 54\r\nCVE-2013-0074, 46\r\nCVE-2013-0422, 47, 49\r\nCVE-2013-2460, 46\r\nCVE-2013-2551, 46, 54\r\nCVE-2013-7331, 54\r\nCVE-2014-0322,","start":237980,"end":238285}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2014-0360","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-0360","exploited":true,"exploitedSince":"2022-05-04","provenance":"source"},"exploits":[{"id":32851,"url":"https://www.exploit-db.com/exploits/32851","title":"Microsoft Internet Explorer 10 - CMarkup Use-After-Free (MS14-012)","type":"remote","platform":"windows","date":"2014-04-14","verified":true,"provenance":"source"},{"id":32904,"url":"https://www.exploit-db.com/exploits/32904","title":"Microsoft Internet Explorer - CMarkup Use-After-Free (MS14-012) (Metasploit)","type":"remote","platform":"windows","date":"2014-04-16","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2014-04-14"},"metasploit":[{"name":"MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free","module":"exploit/windows/browser/ms14_012_cmarkup_uaf","type":"exploit","disclosureDate":"2014-02-13","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms14_012_cmarkup_uaf.rb"}],"first":{"date":"2014-02-13","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms14_012_cmarkup_uaf.rb"},"provenance":"source"},"exploitRefs":["http://www.exploit-db.com/exploits/32851","http://www.exploit-db.com/exploits/32904","https://www.dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip"],"flow":[{"stage":"exploitation","techniques":["T1189"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1068"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2014-02-13","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2014-04-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms14_012_cmarkup_uaf.rb","provenance":"source"},{"date":"2014-02-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0322","provenance":"source"},{"date":"2014-02-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2014-0322","provenance":"source"},{"date":"2014-10-28","kind":"report","label":"Named in blogs.cisco.com: Threat Spotlight: Group 72, Opening the ZxShell","url":"https://blogs.cisco.com/security/talos/opening-zxshell","provenance":"machine"},{"date":"2022-05-04","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-05-04","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-0360","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":3001},"priority":{"score":61.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4640 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9971"},{"name":"Named in threat reports","points":7.74,"detail":"3 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 2 Exploit-DB entries; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":-15.0,"detail":"No patches exist; remove or isolate it"}]},"lineage":{"familyId":"fam-class-microsoft-internet-explorer-cwe-416"}}