CVE-2014-2781

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly restrict the exchange of keyboard and mouse data between programs at different integrity levels, which allows attackers to bypass intended access restrictions by leveraging control over a low-integrity process to launch the On-Screen Keyboard (OSK) and then upload a crafted application, aka "On-Screen Keyboard Elevation of Privilege Vulnerability."

• CWE-264

• http://www.securityfocus.com/bid/68397Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1030535Third Party Advisory, VDB Entry
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-039Patch, Vendor Advisory
• http://www.securityfocus.com/bid/68397Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1030535Third Party Advisory, VDB Entry
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-039Patch, Vendor Advisory

Published

Jul 8, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-2775Microsoft Internet Explorer 9 through 11 allows remote attac…
• CVE-2014-2776Microsoft Internet Explorer 11 allows remote attackers to ex…
• CVE-2014-2777Microsoft Internet Explorer 8 through 11 allows remote attac…
• CVE-2014-2778Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 al…
• CVE-2014-2779mpengine.dll in Microsoft Malware Protection Engine before 1…
• CVE-2014-2780DirectShow in Microsoft Windows Vista SP2, Windows Server 20…
• CVE-2014-2782Microsoft Internet Explorer 9 through 11 allows remote attac…
• CVE-2014-2783Microsoft Internet Explorer 7 through 11 does not prevent us…
• CVE-2014-2784Microsoft Internet Explorer 8 through 11 allows remote attac…
• CVE-2014-2785Microsoft Internet Explorer 7 allows remote attackers to exe…
• CVE-2014-2786Microsoft Internet Explorer 9 through 11 allows remote attac…
• CVE-2014-2787Microsoft Internet Explorer 11 allows remote attackers to ex…