« Back to list

CVE-2014-1809

Status: ModifiedMedium (6.8)—

The MSCOMCTL library in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013 Gold, SP1, RT, and RT SP1 makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted web site, as exploited in the wild in May 2014, aka "MSCOMCTL ASLR Vulnerability."

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Microsoft — Office

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2014-1809",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-05-14T11:13:06.490",
  "references": [
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-024",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-024",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The MSCOMCTL library in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013 Gold, SP1, RT, and RT SP1 makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted web site, as exploited in the wild in May 2014, aka \"MSCOMCTL ASLR Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "La libraría MSCOMCTL en Microsoft Office 2007 SP3, 2010 SP1 y SP2 y 2013 Gold, SP1, RT y RT SP1 facilita a atacantes remotos evadir el mecanismo de protección ASLR a través de un sitio web manipulado, tal y como fue demostrado activamente en mayo 2014, también conocido como 'vulnerabilidad de ASLR de MSCOMCTL.'"
    }
  ],
  "lastModified": "2026-06-17T00:05:35.650",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FEECD12A-5BEF-4675-B62E-86CF4A7474D7"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2010:sp1:x64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8239CEF1-BD02-4ACE-A0C2-75A9EAA15914"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2010:sp1:x86:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8383FADC-9391-4570-AAF9-92A952A4F04F"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2010:sp2:x64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69998A67-CB15-4217-8AD6-43F9BA3C6454"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2010:sp2:x86:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "349E9084-8116-43E9-8B19-CA521C96660D"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2013:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E926E35D-02F6-4EA0-83C5-31443D3A0F01"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "120690A6-E0A1-4E36-A35A-C87109ECC064"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}