CVE-2012-1854

Name: CVE-2012-1854
Creator: NVD / NIST
Published: 2012-07-10T21:55:05.587+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.8/10Actively ExploitedEPSS 21.03%

Last modified Jun 16, 2026

CVE-2012-1854 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Visual Basic for Applications Insecure Library Loading Vulnerability," as exploited in the wild in July 2012.. CISA has confirmed active exploitation in the wild. EPSS estimates a 21.03% chance of exploitation in the next 30 days.

Description

Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Visual Basic for Applications Insecure Library Loading Vulnerability," as exploited in the wild in July 2012.

Metrics

CVSS 3.1

7.8/10

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability

21.03%

97.2th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by Apr 27, 2026.

Weakness Enumeration

CWE-426

Affected Software

Vendor	Product	Versions	Update
Microsoft	Office	2003	Sp3
Microsoft	Office	2007	Sp2
Microsoft	Office	2010	—
Microsoft	Visual Basic For Applications	All versions	—
Microsoft	Visual Basic For Applications Sdk	All versions	—

References

https://www.us-cert.gov/cas/techalerts/TA12-192A.htmlUS Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046Mitigation, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14950Broken Link
https://www.us-cert.gov/cas/techalerts/TA12-192A.htmlUS Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046Mitigation, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14950Broken Link
https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2012/ms12-046Mitigation, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1854US Government Resource

Timeline

Published: Jul 10, 2012
Last Modified: Jun 16, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2012-1854?

How severe is CVE-2012-1854?

CVE-2012-1854 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 21.03% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

How do I fix CVE-2012-1854?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2012

View all 2012CVEs →

Are you affected by CVE-2012-1854?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST