What is CVE-2014-1806?

CVE-2014-1806 is a vulnerability in Microsoft .Net Framework, classified under Code Injection. Published 2014-05-14.

Is CVE-2014-1806 known to be exploited?

9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Microsoft .Net Framework

CVE-2014-1806

The .NET Remoting implementation in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly restrict memory access, which allows remote attackers to execute arbitrary code via vectors involving malformed objects, aka "TypeFilterLevel Vulnerability."

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.396 (98.5th percentile) — read the EPSS interpretation.

Affected products

Microsoft .Net_framework — versions 1.1, 2.0, 3.5
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

Public proof-of-concept exploits

References

secure@microsoft.com (x_refsource_MS, vendor-advisory)
secure@microsoft.com (VDB Entry, vdb-entry, x_refsource_BID)

Frequently asked questions

What is CVE-2014-1806?: CVE-2014-1806 is a vulnerability in Microsoft .Net Framework, classified under Code Injection. Published 2014-05-14.
Is CVE-2014-1806 known to be exploited?: 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.