CVE-2014-4114: Windows OLE Remote Code Execution via Crafted Office Document

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV, has a very high EPSS score, public exploits exist, and it was used in real-world attacks, so unpatched systems face immediate risk.

What it is

CVE-2014-4114 is a remote code execution flaw in Microsoft Windows Object Linking and Embedding (OLE) handling. A crafted OLE object embedded in an Office document can cause Windows to execute arbitrary code. It was exploited in the wild in the 2014 Sandworm attacks, making it a confirmed, high-impact threat to unpatched Windows systems.

Impact

An attacker who convinces a user to open a malicious Office document can execute arbitrary code with the privileges of that user. Successful exploitation can lead to full system compromise, data theft, or installation of additional malware.

Attack surface

The vulnerability is reached locally through a crafted OLE object in an Office document, requiring user interaction to open the file. No authentication is needed, but the attacker must deliver the document to the victim.

Exploitation

CVE-2014-4114 is listed in CISA KEV with a due date of 2022-03-24, and EPSS shows a 30-day probability of 0.81628 (99.6th percentile). Multiple public exploit references exist, and it was exploited in the wild in 2014.

What to do

• Apply the Microsoft security update MS14-060 immediately on all affected Windows versions.
• Disable or restrict OLE object execution in Office documents via Group Policy or Office Trust Center settings where feasible.
• Block or quarantine Office documents from untrusted sources at email and web gateways.
• Upgrade unsupported or end-of-life Windows versions (Vista, 7, 8, 8.1, Server 2008, 2012, RT) to supported releases.
• Educate users not to open unexpected Office attachments or documents from unknown senders.

Detection

• Monitor for Office applications spawning child processes such as cmd.exe, powershell.exe, or wscript.exe.
• Hunt for OLE object files (e.g., .bin, .dat) written to temp or user directories by Office processes.
• Review endpoint logs for suspicious file creation or execution originating from WINWORD.EXE or EXCEL.EXE.
• Search for known exploit indicators from public exploit-db entries 35019, 35020, and 35055 in network or endpoint telemetry.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.