Vulnerability record · CVE-2014-4060 · published 12 August 2014

CVE-2014-4060: Microsoft windows media center use after free vulnerability

Microsoft · Windows Media Center

Use-after-free vulnerability in MCPlayer.dll in Microsoft Windows Media Center TV Pack for Windows Vista, Windows 7 SP1, and Windows Media Center for Windows 8 and 8.1 allows remote attackers to execute arbitrary code via a crafted Office document that triggers deletion of a CSyncBasePlayer object, aka "CSyncBasePlayer Use After Free Vulnerability."

6.8 CVSS 2.0 Medium EPSS 23% · top 2.3% CWE-416 · Use after free

6.8CVSS 2.0 base score

23%EPSS exploitation probability, 30 days

NoNot in CISA KEV

2Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Windows Media Center Microsoft

Windows Media Center Tv Pack Microsoft

References

Link	Tags
http://secunia.com/advisories/60671	Third Party Advisory
http://www.securityfocus.com/bid/69093	Third Party AdvisoryVDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-043	PatchVendor Advisory
http://secunia.com/advisories/60671	Third Party Advisory
http://www.securityfocus.com/bid/69093	Third Party AdvisoryVDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-043	PatchVendor Advisory

Track CVE-2014-4060 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2011-2009Microsoft windows 7 vulnerabilityUntrusted search path vulnerability in Windows Media Center in Microsoft Windows Vista SP2 and Windows 7 Gold and SP1, and Windows Media Center TV Pa…EPSS 5.6%12 Oct 2011 9.3CVE-2011-0032Microsoft windows 7 vulnerabilityUntrusted search path vulnerability in DirectShow in Microsoft Windows Vista SP1 and SP2, Windows 7 Gold and SP1, Windows Server 2008 R2 and R2 SP1, …EPSS 10%9 Mar 2011 7.8CVE-2011-0042Microsoft windows xp media center improper input validation vulnerabilitySBE.dll in the Stream Buffer Engine in Windows Media Player and Windows Media Center in Microsoft Windows XP SP2 and SP3, Windows XP Media Center Edi…EPSS 33%9 Mar 2011 7.0CVE-2026-68820Windows Ancillary Function Driver for WinSock use-after-free privilege escalationThe Windows Ancillary Function Driver for WinSock (afd.sys) contains a use-after-free (CWE-416) that lets an authorized local attacker elevate privil…KEVEPSS 0.33%analysed11 Aug 2026 8.8CVE-2010-0806Microsoft Internet Explorer Peer Objects use-after-free allows remote code executionInternet Explorer 6, 6 SP1 and 7 contain a use-after-free in the Peer Objects component (iepeers.dll), where an object is accessed after deletion, le…KEVEPSS 82%analysed10 Mar 2010 8.8CVE-2010-0249Microsoft Internet Explorer use-after-free enables remote code executionInternet Explorer 6, 7 and 8 mishandle objects in memory, leaving a dangling pointer that can be reused after the object is freed. A remote attacker …KEVEPSS 92%analysed15 Jan 2010 7.8CVE-2020-9715Adobe Acrobat and Reader use-after-free allows code executionAdobe Acrobat and Reader contain a use-after-free (CWE-416) flaw affecting versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and ea…KEVEPSS 49%analysed19 Aug 2020 8.8CVE-2026-5281Google Chrome Dawn use-after-free allows remote code executionChrome versions before 146.0.7680.178 contain a use-after-free flaw in the Dawn graphics component. An attacker who has already compromised the rende…KEVEPSS 0.70%analysed1 Apr 2026

Source: NIST National Vulnerability Database (record CVE-2014-4060), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.