MSCOMCTL.OCX CVE-2012-0158
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionNVD
The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."
AnalysisAI
Remote code execution in Microsoft MSCOMCTL.OCX ActiveX controls allows unauthenticated attackers to execute arbitrary code via maliciously crafted Office documents, RTF files, or web pages. Actively exploited since April 2012 and confirmed in CISA KEV catalog. Despite being patched in 2012, EPSS score of 94.32% (100th percentile) indicates continued exploitation attempts against unpatched systems. Affects broad Microsoft product ecosystem including Office 2003-2010, SQL Server 2000-2008 R2, BizTalk, Commerce Server, Visual FoxPro, and Visual Basic 6.0 Runtime.
Technical ContextAI
The vulnerability resides in four ActiveX controls (ListView, ListView2, TreeView, TreeView2) within MSCOMCTL.OCX, a shared component library used across Microsoft products for rendering common UI elements. The flaw is classified as CWE-94 (Code Injection) and allows attackers to trigger system state corruption when the ActiveX control parses specially crafted embedded objects. MSCOMCTL.OCX shipped with numerous Microsoft products from the late 1990s through 2010, creating extensive exposure. The ActiveX attack surface is particularly dangerous because these controls are automatically instantiated when processing Office documents, RTF files, or visiting web pages containing embedded objects, requiring no explicit user permission beyond opening the file. CPE data confirms impact spans Microsoft Office 2003 SP3 through 2010 SP1, Office Web Components 2003 SP3, SQL Server 2000 SP4 through 2008 R2, BizTalk Server 2002 SP1, Commerce Server 2002 SP4 through 2009 R2, Visual FoxPro 8.0 SP1 and 9.0 SP2, and Visual Basic 6.0 Runtime.
RemediationAI
Apply Microsoft Security Bulletin MS12-027 released April 2012 (https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-027) which provides patches for all affected Microsoft products. For Office products, upgrade to patched versions of Office 2003 (post-MS12-027), Office 2007 (post-MS12-027), or Office 2010 SP1 with MS12-027 applied, or migrate to modern supported Office versions (2016 or later) which are not affected. For SQL Server, apply the cumulative updates specified in MS12-027 or upgrade to SQL Server 2012 or later. Organizations unable to patch immediately should implement application whitelisting to prevent execution of untrusted ActiveX controls via registry modifications (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628} killbit). Block Office documents and RTF files from untrusted sources at email gateways and web proxies. Disable ActiveX controls in Internet Explorer via Group Policy for non-essential users. Note that killbit workarounds may break legitimate functionality in applications relying on MSCOMCTL.OCX controls. Legacy products like Visual Basic 6.0 Runtime and BizTalk Server 2002 require vendor-specific patching or decommissioning as they are no longer supported.
More from same product – last 7 days
Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil
Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal
Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-
Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti
Privilege escalation in Microsoft Entra ID enables remote unauthenticated attackers to bypass origin validation and gain
Share
External POC / Exploit Code
Leaving vuln.today