CVE-2014-4077

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2014-4077 is an elevation-of-privilege vulnerability in the Japanese Input Method Editor (IME) component IMJPDCT.EXE. It affects Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3 when the IME for Japanese is installed. The flaw permits a sandbox protection mechanism to be bypassed when a specially crafted PDF document is processed.

Remote attackers can exploit the issue by supplying a malicious PDF that triggers the IME code path, allowing code execution at a higher privilege level than the sandbox would normally permit. The attack requires user interaction to open the document but needs no additional privileges on the target system.

Microsoft addressed the vulnerability in security bulletin MS14-078, released as part of the November 2014 security updates. Corresponding guidance on risk assessment and patch deployment appears in the associated TechNet Security Research & Defense blog posts.

The vulnerability was exploited in the wild in 2014.