CVE-2014-8985

Exploitation likely. EPSS gives it a 9.8% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.07.5High EPSS percentile96th9.8% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2018-02-08Updated 2024-11-21Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Microsoft Corp Internet ExplorerAffected: 11Upgrade to: not statedStated by: BDU

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether any business PCs still use Microsoft Internet Explorer 11 as a web browser.
Verify those PCs are updated with the fix described in MS14-051 (Microsoft Internet Explorer memory corruption vulnerability).
If IE11 is installed but not needed, remove it or switch users to a supported browser (and restrict IE11 usage).
If you cannot patch right away, block access to untrusted websites and email links in IE11 until updates are installed, then confirm the update is applied.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2810, CVE-2014-2811, CVE-2014-2822, CVE-2014-2823, CVE-2014-4057, and CVE-2014-4145.

In plain language

Written by AI from the record

CVE-2014-8985 is a Microsoft Internet Explorer 11 security flaw where a specially made website could crash the browser or, in some cases, run attacker code—typical small businesses should worry if they still use IE11 and haven’t installed the matching Microsoft update (MS14-051).

In Microsoft Internet Explorer 11, CVE-2014-8985 is a memory-corruption flaw (CWE-119) reachable through a crafted website that can lead to arbitrary code execution or denial of service; a Microsoft remediation is documented in MS14-051, and there’s no CISA KEV listing and no public exploit code on record.

If you're affected

Browser crash and lost work
Possibility of attacker code execution
Account/session compromise risk
Operational disruption from malware

What is it

Imagine a web page that’s like a booby-trapped file: when the browser reads it, it can damage its own memory. That can either make Internet Explorer crash (denial of service) or, more seriously, allow an attacker’s code to run on the computer. The risk is mainly about whether you’re using an unpatched IE11 and whether users can be tricked into visiting a malicious site.

Who is affected

This matters if your business still runs Microsoft Internet Explorer 11 (for example, on older Windows setups, legacy apps, or old internal workflows). The exposure is primarily through visiting a crafted website—so it’s a risk when IE11 is reachable for normal browsing and the system isn’t patched with MS14-051. If IE11 isn’t used, or the security update is installed, the practical risk is much lower.

How urgent is it

This is an AMBER issue: it’s a real memory-corruption bug that can be triggered by a crafted website, and the impact includes potential code execution, not just a crash. However, the findings do not show it is listed in CISA KEV and there is no public exploit code on record, which lowers the certainty of widespread active exploitation.

What to do — in detail

Confirm usage/installation
- Identify endpoints where Microsoft Internet Explorer 11 is installed and actually used by employees.
- Focus on machines used for web browsing and those that might open links from email or chat.
Confirm patch level
- Check whether MS14-051 has been installed on each affected PC.
- Use your standard patch inventory tool (WSUS/SCCM/inventory reports) and validate the KB/update is present.
Upgrade/mitigation path
- If IE11 is not required, disable or remove IE11 and move browsing to a modern, supported browser.
- If IE11 is required for a legacy internal site, ensure MS14-051 is installed and apply any additional IE hardening policies your organization uses.
Temporary workaround if patching is delayed
- Reduce the chance of users landing on malicious pages by tightening web filtering, URL allow/deny lists, and email link protections for IE11 usage.
- Restrict who can open external links in IE11 (for example, limit to trusted users while updates are pending).
What to monitor
- Look for unexpected IE crashes or unusual network connections originating from browser processes.
- If you have endpoint detection tools, review alerts for browser exploitation/memory corruption patterns on the relevant hosts.

Technical context

CVE-2014-8985 is a memory-corruption vulnerability in Microsoft Internet Explorer 11 (CWE-119). The attack vector is visiting a crafted website that triggers the flaw, potentially resulting in arbitrary code execution or a denial of service (browser crash). The findings provided do not include a CISA KEV entry, and no public exploit code is on record; exploitation prevalence is therefore not confirmed in the available data. A vendor remediation exists via Microsoft MS14-051. The public-facing risk for a typical organization is strongest when IE11 is in active use and the MS14-051 fix has not been applied.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

9.8% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

25 events over 3148 days, from the signal feeds we watch.

2026-09-22EPSS band changemoderate → lowepss band change
2026-09-21EPSS band changelow → moderateepss band change
2026-09-06EPSS band changemoderate → lowepss band change
2026-09-05EPSS band changelow → moderateepss band change
2026-08-31EPSS band changemoderate → lowepss band change
2026-08-29EPSS band changelow → moderate

Affected products

Microsoft Corpcommercial · USaka microsoft, microsoft corporation
- Internet ExplorerDesktop AppOn-premConsumer Software / browser

And 2 more affected products. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable