CVE-2014-0322
Microsoft Internet Explorer Use-After-Free Vulnerability
Published Feb 14, 2014 · updated Jun 16, 2026 · microsoft internet explorer
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.
Timeline
Detection, updates, and resolution for this record.
Feb 14, 2014 · Catalog
Detected
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.
May 4, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 25, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.
Required action
Apply updates per vendor instructions.
CISA due date May 25, 2022
Affected
- cpe microsoft/internet explorer10
- cpe microsoft/internet explorer9
- vendor Microsoft Internet Explorerversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2014-0322
Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code.
cisa.gov - CVE.orgVulnerability recordCVE-2014-0322
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2014-0322
30-day exploitation probability 85.1%
first.org - Exploit DatabasePublic exploit reference32851
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit DatabasePublic exploit reference32904
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit ModulesPublic exploit moduleexploit_windows/browser/ms14_012_cmarkup_uaf
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com - NIST NVDVulnerability recordCVE-2014-0322
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February
nvd.nist.gov