CVE-2012-1854
Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
Description
CVE-2012-1854 is a HIGH-severity untrusted search path vulnerability — the "Visual Basic for Applications Insecure Library Loading Vulnerability" — affecting VBE6.dll in Microsoft Office 2003 SP3, Office 2007 SP2 and SP3, Office 2010 Gold and SP1, Microsoft Visual Basic for Applications (VBA), and the Summit Microsoft Visual Basic for Applications SDK, with a CVSS 3.1 score of 7.8. When a user opens an Office document such as a .docx file from a working directory that also contains a malicious DLL, VBA loads the Trojan horse library from the current working directory instead of a trusted system location, executing attacker-controlled code with the user's privileges. Microsoft patched the issue in MS12-046, but CISA added CVE-2012-1854 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-04-13 with a remediation deadline of 2026-04-27 after observing it exploited in the wild again. With an EPSS score of 0.1007 (93.1st percentile) and historical exploitation dating back to July 2012, this Microsoft Office and VBA vulnerability is a high-priority remediation target despite its age.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | office | 2003; 2007; 2010 |
| microsoft | visual basic for applications | All versions |
| microsoft | visual basic for applications sdk | All versions |
References
- http://www.us-cert.gov/cas/techalerts/TA12-192A.html(US Government Resource)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046(Mitigation, Vendor Advisory)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14950(Broken Link)
- https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2012/ms12-046(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1854(US Government Resource)
Weakness Type
CWE-426: Untrusted Search Path
CVE-2012-1854 is classified under CWE-426 — Untrusted Search Path. This weakness occurs when a product searches for critical resources such as libraries or executables using an externally-supplied search path that can point to resources outside the product's direct control. In VBE6.dll, the loader searches the current working directory for dependency DLLs before trusted system locations, so an attacker who places a malicious DLL in the same directory as an Office document can cause Microsoft Office or VBA to load and execute that DLL when the document is opened. The outcome is arbitrary code execution in the context of the Office user, which on typical workstations is sufficient to deploy malware, harvest credentials, or pivot further into the environment.
Learn more: CWE-426 — Untrusted Search Path
Impact Analysis
CVE-2012-1854 carries a CVSS 3.1 score of 7.8 (HIGH) with an unchanged scope, reflecting that successful exploitation fully compromises the Microsoft Office or VBA process on the user's workstation. Attack Vector (Local): exploitation requires the malicious DLL and the lure document to be present in the same working directory on the victim's machine, typically delivered via a network share, USB device, archive, or drive-by download — but this pattern has been operationalized countless times in phishing and watering-hole campaigns. Attack Complexity (Low) and Privileges Required (None): no authentication or special environment is needed beyond a user session. User Interaction (Required): the victim must open the Office file (for example a .docx) that triggers VBA to load VBE6.dll and its malicious neighbor. Confidentiality (High), Integrity (High), and Availability (High): the attacker gains full code execution with the user's privileges, which on standard Office workstations means the ability to read any file the user can read, modify documents and binaries, install persistence, and disrupt the system. With an EPSS score of 0.1007 (93.1st percentile) and CISA-confirmed active exploitation, CVE-2012-1854 sits in the top tier of realistic, high-impact risks for organizations still running unpatched Office 2003, 2007, or 2010.
Exploit Maturity
CVE-2012-1854 has confirmed active exploitation and a long operational history. Historic exploitation: the NVD description explicitly notes it was "exploited in the wild in July 2012," and US-CERT alert TA12-192A (http://www.us-cert.gov/cas/techalerts/TA12-192A.html) tracked the original MS12-046 campaign. Current KEV status: CISA added CVE-2012-1854 to the Known Exploited Vulnerabilities catalog on 2026-04-13 with a remediation deadline of 2026-04-27, indicating renewed real-world exploitation — likely against organizations still operating unsupported Office 2003/2007/2010 deployments. Exploitation probability: the EPSS score of 0.1007 places the vulnerability in the 93.1st percentile, well above typical CVEs in exploitation likelihood. Public tooling: the DLL-hijacking technique underlying CVE-2012-1854 is well-documented and integrated into red-team tradecraft for more than a decade, so working exploitation does not require bespoke development. Ransomware association: no direct ransomware attribution is flagged in KEV, but DLL side-loading via Office documents is a recurring initial-access technique for ransomware affiliates and state-aligned actors, so defenders should treat CVE-2012-1854 as a viable intrusion vector.
Remediation
- Apply Microsoft Security Bulletin MS12-046 to all affected hosts. Per the KEV required action, apply mitigations per vendor instructions; install the patches released under MS12-046 for Office 2003 SP3, Office 2007 SP2/SP3, Office 2010 Gold and SP1, and the Visual Basic for Applications runtimes, using https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046 as the authoritative reference.
- Retire end-of-life Office versions you cannot patch. Office 2003, 2007, and 2010 are long past mainstream support; where MS12-046 cannot be applied cleanly (for example on legacy systems), prioritize migration to a supported Microsoft 365 / current Office release or isolate the host.
- Remove the current working directory from the DLL search path. Reflecting the CWE-426 guidance, ensure affected applications do not load DLLs from the CWD — on Windows this can be enforced via the CWDIllegalInDllSearch registry key set to 0xFFFFFFFF, and by deploying Microsoft's "Insecure Library Loading" workaround documented in MS12-046.
- Block document-plus-DLL delivery at the perimeter. Configure email security and web proxies to strip or quarantine archives (ZIP, RAR, ISO) that combine Office documents with DLLs or executables, and enforce Mark-of-the-Web so Office opens untrusted documents in Protected View.
- Hunt for past exploitation. Review endpoint telemetry, EDR logs, and Office Alerts for DLL loads of VBE6.dll or its dependencies from user-writable paths (Downloads, Temp, network shares), unusual child processes spawned by WINWORD.EXE/EXCEL.EXE, and persistence mechanisms established around July 2012 or after the 2026 KEV listing.
- Harden macro and add-in policies long-term. Disable or sign-restrict VBA macros via Group Policy ("Disable all macros except digitally signed macros" or "Block macros from running in Office files from the Internet"), restrict COM add-ins, and align with Microsoft's recommended secure library loading flags such as LOAD_LIBRARY_SEARCH_SYSTEM32 for any in-house tooling that loads DLLs.
Technical Details
CVE-2012-1854 is an untrusted search path vulnerability in VBE6.dll, the core runtime for Microsoft Visual Basic for Applications shared across Microsoft Office 2003 SP3, Office 2007 SP2 and SP3, Office 2010 Gold and SP1, the standalone VBA runtime, and the Summit Microsoft VBA SDK. Mechanism: when an Office application initializes VBA, VBE6.dll triggers standard Windows library loading for its dependencies; because the current working directory is consulted before trusted system directories, an attacker who controls the CWD can plant a DLL with the expected name and have it loaded in place of the legitimate system library — the classic DLL hijacking / insecure library loading pattern. Delivery: the canonical proof-of-concept demonstrated in July 2012 was a folder containing a benign-looking .docx and a malicious DLL; double-clicking the document instantiates VBA, which loads the rogue DLL and executes its DllMain with the user's privileges. CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): Local attack vector, low complexity, no privileges, required user interaction, unchanged scope, and HIGH impact across confidentiality, integrity, and availability, because arbitrary code execution in the Office user context is the direct outcome. CWE-426 context: the fix — both in MS12-046 and in defensive hardening — is to use fully qualified paths, remove the CWD from the DLL search path via SetDllDirectory(""), and prefer LOAD_LIBRARY_SEARCH_SYSTEM32 for critical loads.
Frequently Asked Questions
Is CVE-2012-1854 being actively exploited?
Yes. The vulnerability was originally exploited in the wild in July 2012 and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-04-13 with a remediation deadline of 2026-04-27. The EPSS score of 0.1007 (93.1st percentile) confirms ongoing high exploitation likelihood; no specific ransomware group is attributed, but DLL hijacking via Office documents is a well-known initial-access technique.
What products are affected by CVE-2012-1854?
CVE-2012-1854 affects VBE6.dll in Microsoft Office 2003 SP3, Office 2007 SP2 and SP3, Office 2010 Gold and SP1, all versions of Microsoft Visual Basic for Applications (VBA), and the Summit Microsoft Visual Basic for Applications SDK. Any workstation or server running these versions — especially long-lived end-of-life Office deployments — is exposed to the insecure library loading behavior.
How do I fix CVE-2012-1854?
Apply Microsoft Security Bulletin MS12-046 (https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046) to all affected Office and VBA installations, and retire any Office 2003, 2007, or 2010 systems that cannot be patched. Enforce Microsoft's Insecure Library Loading hardening (CWDIllegalInDllSearch), use SetDllDirectory("") for in-house loaders, and block delivery of archives that bundle Office documents with DLLs.
How severe is CVE-2012-1854?
CVE-2012-1854 is rated HIGH with a CVSS 3.1 score of 7.8 and an EPSS score of 0.1007 (93.1st percentile). Successful exploitation yields full arbitrary code execution in the user's Office session, and the combination of KEV listing, historical in-the-wild use, and the 2026-04-27 federal remediation deadline makes this Microsoft Office / VBA vulnerability a top-priority patch target.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.