CVE-2014-6332: Windows OLE Automation SafeArrayDimen array redimensioning remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

high priorityIt is a KEV-listed remote code execution flaw with public exploits and very high EPSS probability, but exploitation requires user interaction and the affected platforms are largely legacy.

What it is

OleAut32.dll in Windows OLE mishandles a size value in the SafeArrayDimen function, allowing an array-redimensioning attempt to corrupt memory. A crafted web site can trigger this and execute arbitrary code on the victim's machine. The flaw affects a broad set of legacy Windows client and server releases, so unpatched systems remain exposed.

Impact

An attacker gains arbitrary code execution in the context of the logged-on user, which can lead to full system compromise depending on privileges. Because the vector requires user interaction, the practical gain is code execution on any host where the victim opens the malicious content.

Attack surface

Reached over the network via a crafted web site that the victim must visit or otherwise render, per the CVSS vector AV:N/AC:L/PR:N/UI:R. No authentication is required, but user interaction is required.

Exploitation

CVE-2014-6332 is listed in CISA KEV with a 2022-03-25 addition and a 2022-04-15 due date, and EPSS reports a 30-day probability of 0.94996 (99.857th percentile). Multiple references are tagged Exploit, including Exploit-DB and Packet Storm entries, so public exploit code exists.

What to do

• Apply the Microsoft MS14-064 security update to all affected Windows versions; this is the vendor-recommended fix.
• Retire or isolate unsupported legacy systems such as Windows Server 2003, Vista and Windows RT that cannot be patched.
• Disable or restrict OLE automation and ActiveX/scripting content in browsers and mail clients where feasible.
• Enforce least privilege so a successful exploit runs with limited rights, and block untrusted web content at the perimeter.
• Track KEV remediation deadlines and verify patching through vulnerability scanning.

Detection

• Monitor for OleAut32.dll crashes or unusual SafeArrayDimen-related memory faults in endpoint telemetry.
• Hunt for browser or Office processes spawning unexpected child processes such as cmd.exe, powershell.exe or wscript.exe.
• Inspect web proxy and DNS logs for known exploit-hosting domains and for traffic matching published exploit samples.
• Review endpoint logs for anomalous OLE/ActiveX object instantiation from web or email content.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.