CVE-2012-2539
Microsoft Word Remote Code Execution Vulnerability
Description
CVE-2012-2539 is a remote code execution vulnerability in Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1 that can be exploited through malformed RTF data. The flaw occurs when Word improperly handles specially crafted RTF content, leading to memory corruption that allows an attacker to execute arbitrary code in the context of the current user. With an EPSS score of 94.1% (99.5th percentile), this vulnerability has been heavily targeted by threat actors. CISA has added CVE-2012-2539 to the Known Exploited Vulnerabilities catalog.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | office compatibility pack | - |
| microsoft | office web apps | 2010 |
| microsoft | office word viewer | - |
| microsoft | sharepoint server | 2010 |
| microsoft | word | 2003; 2007; 2010 |
References
- http://www.us-cert.gov/cas/techalerts/TA12-346A.html(Third Party Advisory, US Government Resource)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-079(Patch, Vendor Advisory)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16073(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-2539(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
CVE-2012-2539 results from improper handling of RTF data structures in Microsoft Word. The parser fails to correctly validate certain RTF control words and their parameters, enabling an attacker to inject and execute arbitrary code through a crafted document that corrupts the memory state of the Word process.
Learn more: CWE-94 — Improper Control of Generation of Code
Impact Analysis
CVE-2012-2539 carries a CVSS v2 base score of 9.3 (Critical), reflecting the severe impact of this remote code execution vulnerability. The attack requires user interaction — opening a malicious RTF document — but no authentication or special privileges. Successful exploitation grants the attacker code execution with the privileges of the user running Word, which in many enterprise environments means full desktop access. The EPSS score of 94.1% (99.5th percentile) confirms heavy exploitation activity. This vulnerability is especially dangerous in email-based attack scenarios where RTF documents are commonly exchanged as attachments.
Exploit Maturity
CVE-2012-2539 has been actively exploited in spear-phishing campaigns distributing malicious RTF documents. CISA confirmed active exploitation by adding it to the KEV catalog. The vulnerability has been incorporated into targeted attack toolkits used by advanced persistent threat groups. The EPSS score of 94.1% (99.5th percentile) reflects the significant exploitation activity observed across enterprise environments.
Remediation
- Apply Microsoft security update MS12-079 which addresses the RTF parsing vulnerability in Word. Ensure all Microsoft Word installations are updated to the patched version.
- Upgrade to a current version of Microsoft Office that is actively receiving security updates. Word 2003, 2007, and 2010 are no longer supported and may contain additional unpatched vulnerabilities.
- Configure email gateways to block or quarantine RTF attachments from external senders, as the primary attack vector is through spear-phishing emails with malicious RTF documents.
- Enable Protected View in Microsoft Office which opens documents from untrusted sources in a restricted sandbox, preventing automatic code execution.
- Implement Microsoft Office file validation and deploy application-level controls to prevent the execution of macros and embedded content in documents from untrusted sources.
Technical Details
CVE-2012-2539 is a code execution vulnerability (CWE-94) in Microsoft Word's RTF (Rich Text Format) document parser. The flaw exists in how Word processes certain RTF control words and data structures, where malformed RTF content can trigger memory corruption during parsing. When Word encounters the specially crafted RTF data, improper validation of control word parameters causes a buffer overflow or heap corruption condition. An attacker can carefully construct RTF content that exploits this memory corruption to gain control of the Word process execution flow and execute arbitrary code. The attack is typically delivered through email attachments or document downloads, requiring the victim to open the malicious RTF file in Microsoft Word.
Frequently Asked Questions
Is CVE-2012-2539 being actively exploited?
Yes, CVE-2012-2539 has been actively exploited in targeted spear-phishing campaigns. CISA confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 94.1% reflects substantial exploitation activity.
What products are affected by CVE-2012-2539?
Microsoft Word 2003 SP3, Word 2007 SP2 and SP3, and Word 2010 SP1 are affected. Other Microsoft Office components that handle RTF content may also be at risk.
How do I fix CVE-2012-2539?
Apply Microsoft security update MS12-079 or upgrade to a current supported version of Microsoft Office. Enable Protected View and block RTF attachments from untrusted external sources.
How severe is CVE-2012-2539?
CVE-2012-2539 has a CVSS v2 score of 9.3 (Critical) and enables remote code execution through crafted RTF documents. The EPSS score of 94.1% confirms heavy exploitation, particularly through email-based delivery of malicious documents.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.