CVE-2012-2528

Name: CVE-2012-2528
Creator: NVD / NIST
Published: 2012-10-09T21:55:02.69+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 22.12%

Last modified Jun 16, 2026

CVE-2012-2528 is a vulnerability of currently unknown severity. Use-after-free vulnerability in Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; Word Automation Services on Microsoft SharePoint Server 2010; and Office Web Apps 2010 SP1 allows remote attackers to execute arbitrary code via a crafted RTF document, aka "RTF File listid Use-After-Free Vulnerability.". EPSS estimates a 22.12% chance of exploitation in the next 30 days.

Description

Use-after-free vulnerability in Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; Word Automation Services on Microsoft SharePoint Server 2010; and Office Web Apps 2010 SP1 allows remote attackers to execute arbitrary code via a crafted RTF document, aka "RTF File listid Use-After-Free Vulnerability."

Metrics

EPSS Probability

22.12%

97.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-399

Affected Software

Vendor	Product	Versions	Update
Microsoft	Word Automation Services	All versions	—
Microsoft	Office Compatibility Pack	All versions	Sp2
Microsoft	Office Web Apps	2010	Sp1
Microsoft	Word	2003	Sp3
Microsoft	Word	2007	Sp2
Microsoft	Word	2010	Sp1
Microsoft	Word Viewer	All versions	—

References

http://www.securityfocus.com/bid/55781Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA12-283A.htmlThird Party Advisory, US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-064
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15680
http://www.securityfocus.com/bid/55781Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA12-283A.htmlThird Party Advisory, US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-064
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15680

Timeline

Published: Oct 9, 2012
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2012-2528?

How severe is CVE-2012-2528?

Severity scoring for CVE-2012-2528 is pending analysis. The EPSS model estimates a 22.12% probability of exploitation in the next 30 days.

How do I fix CVE-2012-2528?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2012-2528?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST