Double Free in Microsoft Windows 7

CVE-2014-0301

Double free vulnerability in qedit.dll in DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via a crafted JPEG image, aka "DirectShow Memory Corruption Vulnerability."

Vulnerability class: Double Free

EPSS: 0.140 (96.2th percentile) — read the EPSS interpretation.

Affected products

Microsoft Windows_7
Microsoft Windows_8
Microsoft Windows_8.1
Microsoft Windows_server_2003
Microsoft Windows_server_2008 — versions r2
Microsoft Windows_server_2012 — versions r2
Microsoft Windows_vista
Microsoft Windows_xp
N/a — versions n/a

Weakness classification (CWE)

CWE-415 — Double Free

References

secure@microsoft.com (x_refsource_MS, vendor-advisory, Patch, Vendor Advisory)