CVE-2012-0158
Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
Description
CVE-2012-0158 is a high-severity remote code execution vulnerability in the MSCOMCTL.OCX ActiveX controls used by multiple Microsoft products. The flaw exists in the ListView, ListView2, TreeView, and TreeView2 ActiveX controls within the Common Controls library, allowing a remote attacker to execute arbitrary code and take complete control of an affected system. CISA has confirmed active exploitation by listing this vulnerability in its Known Exploited Vulnerabilities (KEV) catalog. With an exceptional EPSS score of 94.3% (99.9th percentile), CVE-2012-0158 remains one of the most widely exploited vulnerabilities despite being over a decade old, affecting Microsoft Office, SQL Server, BizTalk Server, Commerce Server, Visual FoxPro, and Visual Basic Runtime.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | office | 2003; 2007; 2010 |
| microsoft | office web components | 2003 |
| microsoft | sql server 2000 | - |
| microsoft | sql server 2005 | - |
| microsoft | sql server 2008 | -; r2 |
| microsoft | biztalk server | 2002 |
| microsoft | commerce server | 2002; 2007 |
| microsoft | commerce server 2009 | -; r2 |
| microsoft | visual basic | 6.0 |
| microsoft | visual foxpro | 8.0; 9.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://opensources.info/comment-on-the-curious-case-of-a-cve-2012-0158-exploit-by-chris-pierce/(Broken Link)
- http://www.securityfocus.com/bid/52911(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id?1026899(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id?1026900(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id?1026902(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id?1026903(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id?1026904(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id?1026905(Broken Link, Third Party Advisory, VDB Entry)
- http://www.us-cert.gov/cas/techalerts/TA12-101A.html(Third Party Advisory, US Government Resource)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-027(Patch, Vendor Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74372(Third Party Advisory, VDB Entry)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15462(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0158(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
Code Injection occurs when software constructs code segments using externally-influenced input without properly neutralizing special elements that could modify the intended code. In CVE-2012-0158, the MSCOMCTL.OCX ActiveX controls fail to properly validate input, leading to system state corruption that enables attackers to inject and execute arbitrary code through crafted websites, Office documents, or RTF files.
Learn more: CWE-94 — Improper Control of Generation of Code
Impact Analysis
CVE-2012-0158 carries a CVSS 3.1 score of 8.8 (HIGH), representing a severe threat to organizations running the wide array of affected Microsoft products. The vulnerability is exploitable over the network with low attack complexity and requires no authentication, though user interaction is needed in the form of visiting a malicious website or opening a crafted document. Successful exploitation results in complete compromise of confidentiality, integrity, and availability, giving the attacker full control over the affected system in the context of the current user. The EPSS score of 94.3% in the 99.9th percentile confirms that this vulnerability is among the most actively exploited, and the broad attack surface spanning Office, SQL Server, and multiple other products amplifies organizational risk significantly.
Exploit Maturity
CVE-2012-0158 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-05-03. The EPSS score of 94.3% (99.9th percentile) places this among the most exploited vulnerabilities ever tracked, indicating near-certain exploitation activity even years after disclosure. Despite being published in April 2012, this vulnerability continues to be actively leveraged in spear-phishing campaigns and targeted attacks, as many legacy systems remain unpatched. The vulnerability can be triggered through multiple vectors including crafted websites, Office documents, and RTF files, providing attackers with flexible exploitation options.
Remediation
- Apply Microsoft security bulletin MS12-027 immediately as mandated by the CISA KEV catalog. Install patches from Microsoft Security Updates for all affected products.
- Verify that all instances of affected products have been patched, including Microsoft Office 2003 SP3, 2007 SP2/SP3, and 2010 Gold/SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2/SP3/R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold/R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime.
- Implement kill bits for the vulnerable ActiveX controls via Group Policy to prevent instantiation in Internet Explorer and other ActiveX hosts, even if patching is delayed.
- Deploy email and web content filtering to block malicious Office documents and RTF files targeting this vulnerability, with particular focus on documents containing embedded ActiveX controls.
- Conduct a thorough audit of legacy systems to identify any remaining unpatched installations, as the wide product footprint of this vulnerability means affected components may exist in unexpected locations.
Technical Details
CVE-2012-0158 affects the MSCOMCTL.OCX component, which provides common ActiveX controls (ListView, ListView2, TreeView, TreeView2) used across numerous Microsoft products. The vulnerability triggers system state corruption when a crafted input is processed through these controls, enabling an attacker to redirect execution flow and achieve arbitrary code execution. The CVSS vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects network-based exploitation with low complexity, no privilege requirements, and mandatory user interaction through opening a malicious document or visiting a crafted website. The broad scope of affected products, from Office suites and SQL Server to development tools like Visual FoxPro and Visual Basic Runtime, indicates that the vulnerable MSCOMCTL.OCX component is a shared dependency across Microsoft's product ecosystem, making comprehensive patching essential.
Frequently Asked Questions
Is CVE-2012-0158 being actively exploited?
Yes. CVE-2012-0158 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 94.3% (99.9th percentile) indicates near-certain exploitation activity. Despite being over a decade old, this vulnerability remains widely exploited in targeted attack campaigns.
What products are affected by CVE-2012-0158?
CVE-2012-0158 affects a wide range of Microsoft products including Office 2003, 2007, and 2010; Office Web Components 2003; SQL Server 2000, 2005, and 2008; BizTalk Server 2002; Commerce Server 2002, 2007, and 2009; Visual FoxPro 8.0 and 9.0; and Visual Basic 6.0 Runtime.
How do I fix CVE-2012-0158?
Apply Microsoft security bulletin MS12-027 for all affected products. Additionally, implement ActiveX kill bits for the vulnerable controls and deploy content filtering to block malicious documents targeting this vulnerability.
How severe is CVE-2012-0158?
CVE-2012-0158 has a CVSS 3.1 score of 8.8 (HIGH). With an EPSS score in the 99.9th percentile and a vast attack surface across multiple Microsoft products, this is one of the most severe and widely exploited vulnerabilities in the Microsoft ecosystem.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.