Technical intelligence and weaponization dossier for CVE-2014-6332. Documented exploitation across 1 active malware families totaling 4 analyzed telemetry samples.
| Vulnerability ID | CVE-2014-6332 |
|---|---|
| Common Name / Bulletin | Microsoft Windows OLE Automation Array Remote Code Execution (Unicorn Bug) (MS14-064) |
| CWE Classification | CWE-119: Array Resizing Out-of-Bounds Write |
| Affected Software & Versions | Microsoft Windows 95 through Windows 10 (over 18 years of OS versions) |
| Technical Root Cause | Flaw in OLEAUT32.DLL when resizing SafeArray structures in VBScript inside Internet Explorer, enabling complete ASLR and sandbox bypass. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2014-6332 in enterprise networks:
HTML files containing VBScript with Redim Preserve operations on dynamic arrays exceeding 0x7FFFFFFF elements.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Backdoor & RAT Protection for Businesses →