VIR Vulnerability Intelligence Relay

CVE-2014-4113

unknown KEV
Published 2022-05-04 · Modified 2022-05-04
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
2.5

Description

Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.

CISA KEV

Vendor
Microsoft
Product
Win32k
Due date
2022-05-25

Predictions

Exploit likelihood
99%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-46945 local windows
anonymous · 2014-11-24

Microsoft Windows 8.1/ Server 2012 - 'Win32k.sys' Local Privilege Escalation (MS14-058)

Source code queued for fetch — refresh in a moment.
EDB-39666 local windows
MWR InfoSecurity · 2016-04-05

Microsoft Windows Kernel - 'win32k.sys' Local Privilege Escalation (MS14-058)

Source code queued for fetch — refresh in a moment.
EDB-37064 local windows_x86-64 verified
ryujin · 2015-05-19

Microsoft Windows 8.0/8.1 (x64) - 'TrackPopupMenu' Local Privilege Escalation (MS14-058)

Source code queued for fetch — refresh in a moment.
EDB-35101 local windows verified
Metasploit · 2014-10-28

Microsoft Windows - TrackPopupMenu Win32k Null Pointer Dereference (MS14-058) (Metasploit)

Source code queued for fetch — refresh in a moment.

Metasploit modules

exploit_windows/local/ms14_058_track_popup_menu rank 300
Windows TrackPopupMenu Win32k NULL Pointer Dereference
Source fetch failed: fetch_error — view the original via the link above.

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.