Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11 allows remote attackers to execute arbitrary code.
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-051