Microsoft Fixes 3 Zero

CVE-2014-4113 is a privilege escalation flaw (CWE-264) in Win32k, the kernel-mode component of Microsoft Windows; Microsoft's description is unspecified, but the flaw allows an attacker to gain elevated privileges on the host. It is triggered by executing a specially crafted application locally on an affected system, typically by an attacker who has already obtained a foothold with limited user rights. Successful exploitation yields higher-privilege (kernel/administrator-level) execution, letting the attacker fully compromise the machine and evade user-level restrictions — a common second stage chained after an initial intrusion. Any Microsoft Windows system of the era whose Win32k component was not patched by Microsoft's October 2014 security updates is affected. Exploitation is confirmed: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-05-04), carries a very high EPSS score (87%, ~100th percentile), and public reporting has tied it to threat-actor activity (APT3's Operation Double Tap); no public PoC is catalogued.

Do: Apply Microsoft's October 2014 security updates — or any later cumulative/rollup updates — on all Windows systems, per CISA's required action, prioritizing internet-exposed and high-value hosts listed in the KEV catalog. Confirm the patched Win32k file version on legacy machines that may have missed these updates. Because this is a local privilege escalation typically chained after an initial foothold, also restrict local execution of untrusted code and limit user privileges on any systems that cannot be patched.

CVE-2014-4114 is a flaw in the Windows Object Linking & Embedding (OLE) component, categorized as improper input validation (CWE-20), that permits remote code execution when a user opens a file containing a specially crafted OLE object. It is triggered entirely through user interaction — opening a malicious document such as an Office/PowerPoint file with an embedded OLE object — with no prior authentication or network service exposed. A successful attacker gains code execution in the context of the logged-on user, enabling follow-on actions such as downloading payloads or moving laterally within an enterprise. All affected Windows releases are exposed; Microsoft addressed the flaw in its November 2014 security updates. Exploitation was observed in the wild by the Sandworm threat group using weaponized PowerPoint files, and the flaw carries a very high likelihood of exploitation (EPSS 81.6%, 100th percentile) and was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-03.

Do: Apply Microsoft's Windows OLE security update from the November 2014 release to all affected Windows hosts, per the CISA KEV required action; the CVSS score is not yet published, so treat this as high priority given the RCE impact. As interim mitigation, limit opening of untrusted Office files containing embedded OLE objects and consider restricting OLE object activation for files from the internet zone. For detection, check endpoints for suspicious outbound SMB connections initiated shortly after a user opens a PowerPoint/Office document, a pattern associated with Sandworm exploitation of this flaw.

CVE-2014-4148 is a remote code execution vulnerability in a Windows kernel-mode driver caused by improper handling of TrueType fonts. An attacker triggers it by getting a user to render a specially crafted document or web page containing a malicious embedded TrueType font, at which point the flaw is reached in kernel context. Successful exploitation allows the attacker to execute arbitrary code with elevated kernel privileges, effectively giving full control of the affected host. Any Microsoft Windows system that renders untrusted fonts is affected; the source data identifies Microsoft Windows broadly but does not specify exact affected version ranges. The flaw was exploited as a zero-day (headlines tie it to the Lamberts toolkit) and fixed in Microsoft's October 2014 security updates; CISA added it to the Known Exploited Vulnerabilities catalog on 2022-05-25, and EPSS puts the 30-day exploitation probability at about 60%, though no public proof-of-concept is known.

Do: Apply Microsoft's kernel-mode driver (font handling) security updates from the October 2014 update cycle per the vendor's instructions, as CISA's KEV listing makes patching mandatory for federal agencies. Audit Windows hosts, especially ones that open untrusted documents or web content, for missing patches, since CISA KEV inclusion indicates known in-the-wild exploitation and ransomware relevance is unknown. As defense in depth, restrict rendering of untrusted embedded fonts where your tooling supports it, and prioritize patching internet-facing and shared systems.