Cyber Resilience

CVE-2014-6352

Microsoft Windows Server 2008 r2

CISA KEVActive ExploitationEUVD Exploited
Published
22 October 2014
Modified
22 April 2026
KEV Added
25 February 2022
Patch / advisory
View advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.78 99.5th percentile
Risk Priority 83 floored blend · peak EPSS

Summary

CVE-2014-6352 is a high-severity an unspecified weakness vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).

Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 contain a vulnerability that permits remote attackers to execute arbitrary code through a crafted OLE object. The flaw received a CVSS score of 7.8 and was assigned CWE NVD-CWE-noinfo.

Attackers can deliver the exploit via malicious documents, such as a specially crafted PowerPoint file, enabling them to run arbitrary code on affected systems when the document is opened. The vulnerability was actively exploited in the wild during October 2014.

Public advisories, including the Microsoft Security Research and Defense blog post on November 2014 updates and entries from Secunia, SecurityFocus, and SecurityTracker, address risk assessment and available patches for the issue.

The vulnerability saw confirmed real-world exploitation through PowerPoint documents in October 2014, prior to the release of corresponding security updates.

EU & UK References

Vulnerability Data

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted…

more

OLE object, as exploited in the wild in October 2014 with a crafted PowerPoint document.

CWE(s)
NVD-CWE-noinfo
KEV Date Added
25 February 2022

Related Threats

CVEs Like This One

CVE-2014-4114Same product: Microsoft Windows 7both on KEV
CVE-2015-0016Same product: Microsoft Windows 7both on KEV
CVE-2014-4148Same product: Microsoft Windows 7both on KEV
CVE-2015-2360Same product: Microsoft Windows 7both on KEV
CVE-2015-2426Same product: Microsoft Windows 7both on KEV
CVE-2015-2546Same product: Microsoft Windows 7both on KEV
CVE-2014-6332Same product: Microsoft Windows 7both on KEV
CVE-2015-1769Same product: Microsoft Windows 7both on KEV
CVE-2015-0071Same product: Microsoft Windows 7both on KEV
CVE-2014-4113Same product: Microsoft Windows 7both on KEV

Affected Assets

microsoft
windows 7
all versions
microsoft
windows 8
all versions
microsoft
windows 8.1
all versions
microsoft
windows rt
all versions
microsoft
windows rt 8.1
all versions
microsoft
windows server 2008
all versions, r2
microsoft
windows server 2012
all versions, r2
microsoft
windows vista
all versions

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References