CVEvulnerability

CVE-2012-1856

8.8 HIGH Known exploited Published 2012-08-15 Modified 2026-06-16 Official page ↗

CISA Known Exploited Vulnerability

Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability — Microsoft Office

The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption.

Added to KEV: 2022-03-03
Remediation due: 2022-03-24
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2012-1856

Status: Analyzed
Published: 2012-08-15
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 3.1 ([email protected]): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C

Description

The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Server 2005 SP4, SQL Server 2008 SP2, SP3, R2, R2 SP1, and R2 SP2, Commerce Server 2002 SP4, Commerce Server 2007 SP2, Commerce Server 2009 Gold and R2, Host Integration Server 2004 SP1, Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP2, and Visual Basic 6.0 Runtime allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption, aka "MSCOMCTL.OCX RCE Vulnerability."

Affected configurations

• microsoft commerce server 2002 • microsoft commerce server 2007 • microsoft commerce server 2009 • microsoft host integration server 2004 • microsoft office 2003 • microsoft office 2007 • microsoft office 2010 • microsoft office web components 2003 • microsoft sql server 2000 • microsoft sql server 2005 • microsoft sql server 2008 • microsoft visual basic 6.0 • microsoft visual foxpro 8.0 • microsoft visual foxpro 9.0

References

http://www.securityfocus.com/bid/54948 Broken Link, Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA12-227A.html Third Party Advisory, US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-060 Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15447 Broken Link
http://www.securityfocus.com/bid/54948 Broken Link, Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA12-227A.html Third Party Advisory, US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-060 Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15447 Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1856 US Government Resource