CVE-2014-1767

Microsoft Windows - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2014-1767. PoCs published by Rick Larabee, ExploitCN, AmazingOut.

AI-analyzed exploit summary This exploit targets CVE-2014-1767, a local privilege escalation vulnerability in AFD.SYS on Windows 7 x64. It leverages a dangling pointer to overwrite kernel memory and escalate privileges by manipulating the HalDispatchTable.

Description

Double free vulnerability in the Ancillary Function Driver (AFD) in afd.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."

Exploits (4)

exploitdb WORKING POC
by Rick Larabee · pythonlocalwindows_x86-64
https://www.exploit-db.com/exploits/39525

This exploit targets CVE-2014-1767, a local privilege escalation vulnerability in AFD.SYS on Windows 7 x64. It leverages a dangling pointer to overwrite kernel memory and escalate privileges by manipulating the HalDispatchTable.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Microsoft Windows 7 x64 (afd.sys 6.1.7601.17514)
No auth needed
Prerequisites: Local access to a vulnerable Windows 7 x64 system
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by Rick Larabee · pythonlocalwindows_x86
https://www.exploit-db.com/exploits/39446

This exploit leverages a dangling pointer vulnerability in AFD.SYS (CVE-2014-1767) to achieve local privilege escalation on Windows 7 32-bit systems. It manipulates kernel memory structures to overwrite the HalDispatchTable and execute a token-stealing payload.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Microsoft Windows 7 32-bit (afd.sys 6.1.7600.16385)
No auth needed
Prerequisites: Local access to a vulnerable Windows 7 32-bit system
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by ExploitCN · poc
https://github.com/ExploitCN/CVE-2014-1767-EXP-PAPER

This is a proof-of-concept exploit for CVE-2014-1767, targeting a Windows kernel vulnerability in the AFD driver. It leverages heap manipulation and memory corruption to achieve local privilege escalation by overwriting the HalDispatchTable.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Microsoft Windows (x64) with AFD driver (tested on Windows 7)
No auth needed
Prerequisites: Local access to a vulnerable Windows system · x64 architecture
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WORKING POC
by AmazingOut · cpoc
https://github.com/AmazingOut/CVE_POC/tree/main/CVE-2014-1767

This repository contains a functional exploit for CVE-2014-1767, a Windows kernel vulnerability (Double Free) affecting Windows 7 x86 SP1. The exploit leverages the NtCreateWorkerFactory and NtSetInformationWorkerFactory APIs to achieve local privilege escalation (LPE) by manipulating kernel structures and replacing the current process token with the SYSTEM token.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Microsoft Windows 7 x86 SP1
No auth needed
Prerequisites: Windows 7 x86 SP1 · Compiled with VS2013 · Administrative or local user access
devstral-2 · analyzed Feb 27, 2026 Full analysis →

References (6)

Core 6
Core References
VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/68394
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/39525/
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59778
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/39446/

Scores

EPSS 0.1269
EPSS Percentile 95.7%

Details

CWE
CWE-415
Status published
Products (11)
microsoft/windows_7
microsoft/windows_8
microsoft/windows_8.1
microsoft/windows_rt
microsoft/windows_rt_8.1
microsoft/windows_server_2003
microsoft/windows_server_2008
microsoft/windows_server_2008 r2 sp1
microsoft/windows_server_2012
microsoft/windows_server_2012 r2
... and 1 more
Published Jul 08, 2014
Tracked Since Feb 18, 2026