CVE-2014-0322: Microsoft Internet Explorer use-after-free allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is listed in CISA KEV as exploited in the wild, has a very high EPSS score, and public exploit code exists, so unpatched IE 9/10 systems face immediate compromise risk.

What it is

Internet Explorer 9 and 10 contain a use-after-free (CWE-416) flaw reachable through crafted JavaScript involving CMarkup and the onpropertychange attribute of a script element. Successful exploitation lets a remote attacker run arbitrary code in the context of the browsing user, and the flaw was exploited in the wild in January and February 2014.

Impact

An attacker gains arbitrary code execution with the privileges of the logged-on user, which can lead to full system compromise depending on that user's rights. The record does not state any additional impact beyond code execution.

Attack surface

Reached over the network via a crafted web page or script; the CVSS vector shows no privileges required but user interaction required, so a victim must browse to or be lured to attacker-controlled content. No authentication is needed by the attacker.

Exploitation

CISA KEV lists it as exploited in the wild (added 2022-05-04), EPSS 30-day probability is 0.85175 (99.7th percentile), and references include Exploit-DB entries and a public exploit archive, indicating mature public exploitation. KEV notes no known ransomware campaign use.

What to do

• Apply the Microsoft fix in MS14-012 (security advisory 2934088) or later cumulative updates for affected IE versions.
• Retire or upgrade Internet Explorer 9 and 10; migrate users to a supported browser.
• Enforce EMET or equivalent exploit mitigations on systems that must still run affected IE versions.
• Restrict or block outbound browsing to untrusted sites and filter malicious script content at the network edge.
• Disable or restrict ActiveX and script execution where business needs allow.

Detection

• Hunt for IE 9/10 processes spawning child processes or making unexpected network connections, which can indicate post-exploitation activity.
• Monitor for crashes in mshtml.dll or IE rendering components consistent with use-after-free exploitation.
• Review proxy and DNS logs for watering-hole or exploit-delivery domains tied to known campaigns against this CVE.
• Alert on known public exploit signatures for CVE-2014-0322 in IDS/IPS and endpoint telemetry.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.