HighCISA KEVExploited in the wildPublic exploit

Use-after-free in Microsoft Internet Explorer 9 and 10

IdentifiersCVE-2014-0322CWE-416· Use After Free

CVE-2014-0322 is a use-after-free vulnerability in Microsoft Internet Explorer 9 and 10. According to the provided content, the flaw can be triggered via crafted JavaScript involving CMarkup and the onpropertychange attribute of a script element. Successful exploitation allows a remote attacker to execute arbitrary code in the context of the affected browser process. The vulnerability was exploited in the wild in January and February 2014, including in watering-hole activity associated with Operation Dust Storm.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation enables arbitrary code execution on the victim system through the browser. In practical terms, this can allow an attacker to run malware or follow-on payloads when a user visits a malicious or compromised website, as reflected in the provided context referencing watering-hole exploitation and malware delivery.

Mitigation

If you can’t patch tonight, do this now.

Until patching is completed, reduce exposure by restricting or disabling use of affected Internet Explorer versions, especially for browsing untrusted or internet-hosted content. Use Microsoft's Enhanced Mitigation Experience Toolkit or equivalent exploit mitigations where available, enforce least-privilege user contexts, and limit access to potentially compromised websites to reduce watering-hole risk.

Remediation

Patch, then assume compromise.

Apply the Microsoft security update that addresses CVE-2014-0322 for affected Internet Explorer versions. Upgrade unsupported or unpatched systems to a fixed version of Internet Explorer or a supported platform receiving security updates. Prioritize patching Internet Explorer 9 and 10 systems exposed to untrusted web content.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.

VALID 0 / 1 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationInternet Explorerapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

mitre attack websiteNews

Mar 20, 2015

Exploit Public-Facing Application, Technique T1190 - Enterprise | MITRE ATT&CK®

A vulnerability used to drop ZxShell malware.

mitre attackNews

Jan 25, 2026

Exploitation for Client Execution, Technique T1203 - Enterprise | MITRE ATT&CK®

A vulnerability exploited by Axiom for code execution (product not specified in the content).

mitre attackNews

Jan 25, 2026

Exploit Public-Facing Application, Technique T1190 - Enterprise | MITRE ATT&CK®

A vulnerability used as an exploitation vector to drop the ZxShell malware.

mitre attackNews

Jan 25, 2026

Drive-by Compromise, Technique T1189 - Enterprise | MITRE ATT&CK®

A then-zero-day vulnerability in Microsoft Internet Explorer that was exploited via a watering-hole attack to gain initial access to victims.

+4 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence3

Every observed campaign linking this CVE to a named adversary.

Associated malware2

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2014-0322

NVD

nvd.nist.gov/vuln/detail/CVE-2014-0322

MITRE CWE · CWE-416

Use After Free

Patch

technet.microsoft.com/security/advisory/2934088

Patch

docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012

Third Party Advisory

exploit-db.com/exploits/32851

Third Party Advisory

exploit-db.com/exploits/32904

Third Party Advisory

kb.cert.org/vuls/id/732479

Press/Media Coverage

twitter.com/nanoc0re/statuses/434251658344673281

US Government Resource

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0322