CVE-2014-6363

Microsoft VBScript 5.6-5.8 - Remote Code Execution via Memory Corruption

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-6363. PoCs published by Skylined.

AI-analyzed exploit summary This exploit leverages a use-after-free vulnerability in the VBScript engine (CVE-2014-6363) by manipulating the RegExp object to trigger uninitialized memory access, leading to arbitrary code execution. The PoC includes scripts for Windows Script Host, Internet Explorer, and IIS.

Description

vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability."

Exploits (1)

exploitdb WORKING POC VERIFIED
by Skylined · htmlremotewindows
https://www.exploit-db.com/exploits/40721

This exploit leverages a use-after-free vulnerability in the VBScript engine (CVE-2014-6363) by manipulating the RegExp object to trigger uninitialized memory access, leading to arbitrary code execution. The PoC includes scripts for Windows Script Host, Internet Explorer, and IIS.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft VBScript Engine (vbscript.dll 5.6-5.8), Internet Explorer 8-11, Windows Script Host, IIS with ASP
No auth needed
Prerequisites: Target must execute the crafted VBScript (via IE, WSH, or IIS ASP)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/40721/

Scores

EPSS 0.2683
EPSS Percentile 96.5%

Details

CWE
CWE-399
Status published
Products (9)
microsoft/internet_explorer 6
microsoft/internet_explorer 7
microsoft/internet_explorer 8
microsoft/internet_explorer 9
microsoft/internet_explorer 10
microsoft/internet_explorer 11
microsoft/vbscript 5.6
microsoft/vbscript 5.7
microsoft/vbscript 5.8
Published Dec 11, 2014
Tracked Since Feb 18, 2026