Unscored severity · published May 20, 2014
CVE-2014-3802
msdia.dll in Microsoft Debug Interface Access (DIA) SDK, as distributed in Microsoft Visual Studio before 2013, does not properly validate an unspecified variable before use in…
–
CVSS
10.9%
EPSS
No
On KEV
Description
msdia.dll in Microsoft Debug Interface Access (DIA) SDK, as distributed in Microsoft Visual Studio before 2013, does not properly validate an unspecified variable before use in calculating a dynamic-call address, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDB file.
Exploitation
Is it being used?
Exploit prediction (EPSS)10.9% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
Debug Interface Access Software Development Kit · Microsoft
All versions, or not specified · source: NVD
VS
Visual Studio · Microsoft
through 2012; 2002; 2003; 2005; 2010; 2010 · source: NVD
Affected product
DI
Debug Interface Access Software Development Kit
Microsoft