CVE-2012-0158 Microsoft MSCOMCTL.OCX Remote Code Execution
Remote attackers can execute arbitrary code via crafted documents or websites exploiting MSCOMCTL.OCX ActiveX controls in Microsoft Office and related products.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2012-0158?
CVE-2012-0158 is a high-severity code injection vulnerability in Microsoft Office, published on 10 Apr 2012. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."
Weakness: CWE-94
Which versions are affected by CVE-2012-0158?
It affects 10 products.
Products include Microsoft Biztalk Server, Microsoft Commerce Server, Microsoft Commerce Server 2009, Microsoft Office, Microsoft Office Web Components, Microsoft Sql Server 2000 and 4 more.
How do I fix CVE-2012-0158?
No fix has been published for CVE-2012-0158 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2012-0158 being exploited?
Yes. Attackers have exploited CVE-2012-0158 in the wild since at least 3 Nov 2021, including in ransomware campaigns.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 2 proofs of concept on GitHub.
Other vulnerabilities in Microsoft Office
Sources
Also known as GHSA-xc3w-wqx5-qrf9.