Security readout for executives and security teams
Plain-English summary
CVE-2014-6352 is a Windows OLE remote code execution flaw. A victim must interact with a malicious document, reported as crafted PowerPoint in 2014. Successful exploitation could let an attacker run code with the user’s privileges. CISA KEV listing confirms known exploitation, so remaining legacy Windows exposure deserves urgent attention.
Executive priority
Treat this as a high-priority legacy Windows risk. It is old, known exploited, and can allow code execution through document handling. The business decision is whether any affected systems remain and, if so, how quickly they can be patched, isolated, or retired.
Technical view
The issue affects Microsoft Windows Vista SP2, Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8/8.1, Server 2012/R2, and Windows RT versions. The vulnerability is triggered through a crafted OLE object and can lead to arbitrary code execution after user interaction. CVSS v3.1 is 7.8 high.
Likely exposure
Exposure is most likely on legacy or unsupported Windows hosts still processing Office, PowerPoint, or OLE-containing documents. End-user workstations, terminal servers, and older file-review workflows are the main concern. Modern fully patched systems may not be affected, but the bundle does not prove current patch status.
Exploitation context
The CVE description states exploitation in the wild in October 2014 using a crafted PowerPoint document. CISA KEV inclusion confirms known exploitation. The sources do not establish current active exploitation campaigns, public exploit availability, or the exact targeting scope.
Researcher notes
Key gaps are product/version specificity beyond the CVE text and current exploitation details. The bundle supports known historical exploitation and KEV status, but not live campaign activity. Validation should focus on OS inventory, Microsoft bulletin applicability, and document-ingestion paths.
Mitigation direction
- Use Microsoft MS14-064 guidance to identify and apply applicable security updates.
- Prioritize remediation for CISA KEV-tracked assets and document-handling systems.
- Retire, upgrade, or isolate unsupported affected Windows versions.
- Limit exposure to untrusted Office, PowerPoint, and OLE-containing documents.
- Check current vendor guidance where patch applicability is unclear.
Validation and detection
- Inventory hosts running the Windows versions named in the CVE description.
- Confirm whether MS14-064 or superseding Microsoft updates are installed.
- Review email, document-processing, and terminal-server workflows for affected legacy systems.
- Verify security controls flag or restrict suspicious OLE-containing documents.
- Document exceptions where systems cannot be patched or upgraded.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2014-6352 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- ms-win-ole-cve20146352-code-exec(97714)CVE reference · vdb-entry, x_refsource_XF
- MS14-064CVE reference · vendor-advisory, x_refsource_MS
- https://technet.microsoft.com/library/security/3010060CVE reference · x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-6352CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.