ZeroDay Findings
Sign inSign up

Findings

CVE-2014-4148

Microsoft Windows Remote Code Execution Vulnerability

Published Oct 15, 2014 · updated Jun 16, 2026 · microsoft windows 7

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted TrueType font, as exploited in the wild in October 2014, aka "TrueType Font Parsing Remote Code Execution Vulnerability."

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2014 · Catalog

    Detected

    win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted TrueType font, as exploited in the wild in October 2014, aka "TrueType Font Parsing Remote Code Execution

  2. May 25, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted TrueType font, as exploited in the wild in October 2014, aka "TrueType Font Parsing Remote Code Execution

Required action

Apply updates per vendor instructions.

CISA due date Jun 15, 2022

Affected

  • cpe microsoft/windows 7version unspecified
  • cpe microsoft/windows 8version unspecified
  • cpe microsoft/windows 8.1version unspecified
  • cpe microsoft/windows rtversion unspecified
  • cpe microsoft/windows rt 8.1version unspecified
  • cpe microsoft/windows server 2003version unspecified
  • cpe microsoft/windows server 2008version unspecified
  • cpe microsoft/windows server 2008r2
  • vendor Microsoft Windowsversion unspecified

Sources

  • CISA KEVCVE-2014-4148

    A remote code execution vulnerability exists when the Windows kernel-mode driver improperly handles TrueType fonts.

    cisa.gov
  • CVE.orgCVE-2014-4148

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2014-4148

    30-day exploitation probability 59.9%

    first.org
  • NIST NVDCVE-2014-4148

    win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code

    nvd.nist.gov

References