cbcvebase.
CVE-2014-4141
published 2014-10-15

CVE-2014-4141: Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web…

PriorityP260critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
30.51%
98.0th percentile
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

Affected

4 ranges
VendorProductVersion rangeFixed in
microsoftinternet_explorer——
microsoftinternet_explorer——
microsoftinternet_explorer——
microsoftinternet_explorer——

Detection & IOCsextracted from sources · hover to see the quote

  • →Exploit triggers a CAttrArray Use-After-Free in MSHTML via specific DOM property assignments on a textarea element, including dataSrc, id, innerHTML, onvolumechange, and a CSS list-style url() property set via setProperty ↗
  • ·Vulnerability affects Internet Explorer 8 through 11; the exploit PoC specifically targets IE9 MSHTML CAttrArray Use-After-Free (MS14-056) ↗
  • ·The exploit is delivered via a crafted web site; no network-based IOCs (domains, IPs, hashes) are present in the available source material ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.