CVE-2014-4148
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Oct 15, 2014
Updated: Dec 20, 2024
CWE ID 94
Summary
CVE-2014-4148 is a remote code execution vulnerability affecting the win32k.sys module in various Microsoft Windows operating systems, including Windows Server 2003 SP2, Windows Vista SP2, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2. The issue stems from a flaw in the TrueType font parsing functionality in kernel-mode drivers. Malicious actors can exploit this vulnerability by utilizing specially crafted TrueType fonts to execute arbitrary code, as demonstrated in the wild in October 2014.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Microsoft Windows Server 2008
- Microsoft Windows 7
- Microsoft Windows Server 2003
- Microsoft Windows 8.1
- Microsoft Windows Server 2012
Affected Vendors
- Microsoft