Actively exploited · Published Nov 11, 2014 · Assigned by microsoft

CVE-2014-4077

High 7.8 Exploited

In plain English

A high-severity security flaw in Input Method Editor (IME) Japanese from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on May 25, 2022). The chance it is exploited in the next 30 days is estimated at 54.6% (higher than 99.0% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)54.6%top 1.0% of all CVEs

Exploited in the wildYesCISA KEV since May 25, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 15, 2022.

Official description

Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.EXE (aka IME for Japanese) is installed, allow remote attackers to bypass a sandbox protection mechanism via a crafted PDF document, aka "Microsoft IME (Japanese) Elevation of Privilege Vulnerability," as exploited in the wild in 2014.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

1031197 vdb-entry, x_refsource_SECTRACK
http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx x_refsource_CONFIRM
MS14-078 vendor-advisory, x_refsource_MS
1031196 vdb-entry, x_refsource_SECTRACK
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-4077 government-resource