CVE-2014-1776
Microsoft Internet Explorer Memory Corruption Vulnerability
Published Apr 27, 2014 · updated Jun 16, 2026 · microsoft internet explorer
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014. NOTE: this issue originally emphasized VGX.DLL, but Microsoft clarified that "VGX.DLL does not contain the vulnerable code leveraged in this exploit. Disabling VGX.DLL is an exploit-specific workaround that provides an immediate, effective workaround to help block known attacks."
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 27, 2014 · Catalog
Detected
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014. NOTE: this issue originally emphasized VGX.DLL, but Microsoft clarified that "VGX.DLL does not contain the vulnerab
Jan 28, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jul 28, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014. NOTE: this issue originally emphasized VGX.DLL, but Microsoft clarified that "VGX.DLL does not contain the vulnerab
Required action
Apply updates per vendor instructions.
CISA due date Jul 28, 2022
Affected
- cpe microsoft/internet explorer10
- cpe microsoft/internet explorer11
- cpe microsoft/internet explorer6
- cpe microsoft/internet explorer7
- cpe microsoft/internet explorer8
- cpe microsoft/internet explorer9
- vendor Microsoft Internet Explorerversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2014-1776
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user.
cisa.gov - CVE.orgVulnerability recordCVE-2014-1776
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2014-1776
30-day exploitation probability 82.7%
first.org - NIST NVDVulnerability recordCVE-2014-1776
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2
nvd.nist.gov