CVE-2012-1854
mediumpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.209 · 98 %ileEUUSadded 2026-04-13remediate by 2026-04-27
required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
EPSS · scored 2026-10-22
Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Visual Basic for Applications Insecure Library Loading Vulnerability," as exploited in the wild in July 2012.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (6)
Products and version ranges known to be affected.
- microsoft visual basic for applicationsall versionsnvdUScpe:2.3:a:microsoft:visual_basic_for_applications:*:*:*:*:*:*:*:*
- microsoft visual basic for applications sdkall versionsnvdUScpe:2.3:a:microsoft:visual_basic_for_applications_sdk:*:*:*:*:*:*:*:*
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- http://secunia.com/advisories/49800cnnvd
- http://technet.microsoft.com/security/bulletin/MS12-046cnnvd
- http://technet.microsoft.com/zh-cn/security/bulletin/ms12-046Patchcnnvd
- http://www.us-cert.gov/cas/techalerts/TA12-192A.htmlenisa_euvd
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046enisa_euvd
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14950enisa_euvd
- http://www.us-cert.gov/cas/techalerts/TA12-192A.htmlUS Government Resourcenvd
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046MitigationVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan