How severe is CVE-2014-6334?

CVE-2014-6334 has a CVSS 2.0 base score of 9.3, rated critical severity.

Is CVE-2014-6334 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 17% (97th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2014-6334?

CVE-2014-6334 primarily affects Microsoft Office Compatibility Pack. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2014-6334?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2014-6334 published?

CVE-2014-6334 was published on 2014-11-11 and last updated on 2026-06-17.

CVE-2014-6334

CVE-2014-6334 is a critical-severity vulnerability in Microsoft Office Compatibility Pack with a CVSS 2.0 base score of 9.3. Its EPSS exploit-prediction score of 17% places it in the 97th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-94.

Key facts

Severity: Critical (CVSS 2.0 base score 9.3)
EPSS exploit prediction: 17% (97th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-94
Affected product: Microsoft Office Compatibility Pack
Published: 2014-11-11
Last modified: 2026-06-17

Description

Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Bad Index Remote Code Execution Vulnerability."

Frequently asked questions

What is CVE-2014-6334?: Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Bad Index Remote Code Execution Vulnerability."
How severe is CVE-2014-6334?: CVE-2014-6334 has a CVSS 2.0 base score of 9.3, rated critical severity.
Is CVE-2014-6334 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 17% (97th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2014-6334?: CVE-2014-6334 primarily affects Microsoft Office Compatibility Pack. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2014-6334?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2014-6334 published?: CVE-2014-6334 was published on 2014-11-11 and last updated on 2026-06-17.

References

Affected products (3)

cpe:2.3:a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_word_viewer:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*

More vulnerabilities in Microsoft Office Compatibility Pack

CVE-2015-6177 — Critical (CVSS 9.3): Microsoft Excel 2007 SP3, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary…
CVE-2015-6172 — Critical (CVSS 9.3): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2016, Word 2013 RT SP1, and Office…
CVE-2015-6124 — Critical (CVSS 9.3): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, and Office Compatibility Pack…
CVE-2015-6122 — Critical (CVSS 9.3): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011, Office Compatibility Pack SP3, and Excel Viewer allow…
CVE-2015-6040 — Critical (CVSS 9.3): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and…
CVE-2015-6092 — Critical (CVSS 9.3): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Office…

All CVEs affecting Microsoft Office Compatibility Pack →

Other CWE-94 (Code Injection) vulnerabilities

CVE-2026-76605 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.3 - ???.
CVE-2026-76604 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.3 - The…
CVE-2026-67364 — Critical (CVSS 10.0): Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1:…
CVE-2026-73343 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
CVE-2026-74253 — Critical (CVSS 10.0): Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 14.0.0…
CVE-2026-73678 — Critical (CVSS 10.0): MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that…

Browse all CWE-94 (Code Injection) vulnerabilities →