BendyBear: Novel Chinese Shellcode Linked With Cyber Espionage Group BlackTech
Mentions the CVE; no further detail.
CVE-2014-6332 KEVPublic exploit High · 8.8 EPSS 94.9%
Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability
Microsoft · Windows
Summary
The flaw is in OleAut32.dll, the OLE Automation component of Microsoft Windows, where improper handling of a size value in the SafeArrayDimen function (triggered by an array-redimensioning attempt) allows memory-related code execution. An attacker can execute arbitrary code by luring a user to a crafted web site, with no authentication required but user interaction needed to visit the page.
Official description · NVD
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka "Windows OLE Automation Array Remote Code Execution Vulnerability."
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
89.1 / 100
- Exploited
- Yes, in CISA KEV
- Reports
- 5
- Tactics
- 2/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 3 months after disclosure. Public exploit code (Exploit-DB) appeared 2 days after disclosure.
- Disclosedday 0
- Public exploit codeExploit-DB+2 days
- First seen exploitedVulnCheck KEV evidence+3 mo
- Named in a threat reportunit42.paloaltonetworks.com+6 yrs
- Added to CISA KEVEU database agrees+7 yrs
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
2 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order, 2 cited passages 2Initial AccessTA0001
Drive-by Compromise T1189 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the CVE · uncategorised
ExecutionTA0002
Exploitation for Client Execution T1203 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the CVE · uncategorised
Detection
0 rules for this CVE · 38 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2014-6332 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Drive-by CompromiseT11893 general rules
Exploitation for Client ExecutionT120335 general rules
- Antivirus - Exploitation Framework Signaturecriticalstable
- Droppers Exploiting CVE-2017-11882criticalstable
- Audit CVE Eventcriticaltest
- CVE-2021-31979 CVE-2021-33771 Exploitscriticaltest
- CVE-2021-31979 CVE-2021-33771 Exploits by Sourgumcriticaltest
- Exploit for CVE-2017-8759criticaltest
- Antivirus - APT Malware Signaturecriticalexperimental
- Antivirus - Remote Access Tools Signaturecriticalexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Named in 5 threat reports5 reportsMicrosoft2Unit 42SentinelOne+1Feb 2021 · 4 undated
Reports are matched by finding the exact id CVE-2014-6332 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Microsoft Security
…ams 0.00% 0.05% 0.10% 0.15% 0.20% 0.25% 3Q15 4Q15 1Q16 2Q16 Encounter rate (percent of all reporting computers) Win32/CplLnk (see below) 0.000% 0.001% 0.002% 0.003% 0.004% 0.005% 0.006% 0.007% 0.008% 3Q15 4Q15 1Q16 2Q16 Encounter rate (percent of all reporting computers) Unix/Lotoor CVE-2014-6332…
4 passages name itOriginal (opens in a new tab) ↗
Microsoft Security
Exploit kit 0.60% 0.42% 0.22% 0.04% JS/Neclu Exploit kit 0.11% 0.06% 0.03% 0.14% HTML/IframeRef Generic 0.10% 0.09% 0.07% 0.05% HTML/Meadgive Exploit kit 0.15% 0.08% 0.06% 0.05% JS/NeutrinoEK Exploit kit 0.00% 0.01% 0.07% 0.04% Win32/Sdbby Other — — 0.00% 0.09% CVE-2014-6332 Operating system — 0.03% 0.04%…
3 passages name itOriginal (opens in a new tab) ↗
Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years
In addition, they were also aware that another malicious script had been injected into the same website in November 2014, leveraging CVE-2014-6332 to download a trojan horse to the target’s host.
Show all 5 reportsShow fewer
RECON MTL 2017 evolution of pirpi
Mentions the CVE; no further detail.
Also mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX