Product:
Windows
Summary
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object. This vulnerability was actively exploited in October 2014 using a malicious PowerPoint document.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2014-6352 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious OLE object and embed it within a PowerPoint document. When the victim opens the document, the crafted object can execute arbitrary code on the victim’s system, potentially allowing the attacker to gain control over the affected machine.
Affected Products
- Windows Vista SP2: An older version of Windows that is no longer supported.
- Windows Server 2008 SP2: A server operating system that is vulnerable to remote code execution.
- Windows 7 SP1: A widely used operating system that can be compromised through this vulnerability.
- Windows 8 and 8.1: These versions are also susceptible to the exploitation of crafted OLE objects.
- Windows Server 2012 Gold and R2: Server versions that are affected by this vulnerability.
- Windows RT Gold and 8.1: Tablet versions of Windows that are vulnerable as well.
Mitigation
To mitigate this vulnerability, users should apply the latest security updates provided by Microsoft. Following vendor instructions for updates is crucial to protect systems from potential exploitation.