PT-2012-3598 · Microsoft+1 · Visual Basic For Applications+2

Bai Haowen · Published 2012-07-10 · Updated 2026-04-14 · CVE-2012-1854

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Office versions 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1 Microsoft Visual Basic for Applications (VBA) Summit Microsoft Visual Basic for Applications SDK

Description The issue allows local users to gain privileges via a Trojan horse DLL in the current working directory. This can be exploited by placing a malicious DLL in a directory that contains a .docx file. The vulnerability has been exploited in the wild. It is a remote code execution vulnerability that exists in the way Microsoft Visual Basic for Applications handles the loading of DLL files, potentially allowing an attacker to take complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Office 2003 SP3, consider disabling the loading of external DLL files until a patch is available. For Microsoft Office 2007 SP2 and SP3, restrict access to the VBE6.dll module to minimize the risk of exploitation. For Microsoft Office 2010 Gold and SP1, avoid using the vulnerable VBA functionality in sensitive environments until the issue is resolved. For Microsoft Visual Basic for Applications (VBA), consider implementing additional security measures to prevent the loading of malicious DLL files. For Summit Microsoft Visual Basic for Applications SDK, restrict the use of the SDK in environments where the vulnerability could be exploited.

Fix

RCE

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2012-1854

Affected Products

Office

Visual Basic For Applications

Summit Microsoft Visual Basic For Applications Sdk

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2012-1854 · Security Note
• https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046 · Security Note
• https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2012/ms12-046 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1854 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA12-192A.html · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms12-046 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14950 · Note
• https://twitter.com/ElusivePrivacy/status/2044175188779012358 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1854 · Note