MSCOMCTL.OCX CVE-2012-0158
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconDeliver spear-phishing email with malicious attachment
-
DeliveryUser opens Office/RTF document
-
ExploitMSCOMCTL.OCX ActiveX control instantiated
-
InstallTrigger system state corruption via crafted object
-
C2Execute arbitrary shellcode
-
ExecuteEstablish persistence or C2
-
ImpactExfiltrate data or pivot laterally
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A03:2021 - Injection
ASVS 5.0
V5 - Validation, Sanitization and Encoding Input validation, output encoding, parameterized queries
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target system to have an unpatched version of MSCOMCTL.OCX installed (any affected product listed in CPE data) and user interaction to open a malicious Office document, RTF file, or visit a crafted webpage. CVSS vector PR:N confirms no authentication is required - attackers need only social engineering to convince users to open malicious files. UI:R indicates required user interaction is the primary limiting factor. Default configurations of all affected Microsoft products are vulnerable with no special features or non-default settings required. However, organizations with application whitelisting, ActiveX controls disabled via Group Policy, or Protected View enabled in Office 2010 may prevent exploitation. Email attachments from external sources are the most common delivery vector. Systems where users operate with administrative privileges face higher impact as shellcode executes with those elevated permissions. |
| Impact | This vulnerability represents an exceptionally high real-world risk despite its 2012 patch date. CISA KEV listing confirms active exploitation in production environments. The EPSS score of 94.32% at the 100th percentile indicates exploitation attempts remain widespread over a decade later, likely targeting organizations with legacy systems or incomplete patch coverage. CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H shows network-based attack requiring only user interaction (opening a document or visiting a webpage) with no authentication needed. Attack complexity is low, enabling reliable exploitation. Public exploit code availability lowers the skill barrier for attackers. The combination of confirmed active exploitation, extremely high EPSS score, low attack complexity, and public POC makes this a critical priority for remediation even in 2025. However, the UI:R requirement means basic email security controls and user awareness can partially mitigate risk. Organizations still running affected products without patches face near-certain compromise if exposed to targeted attacks. The persistence of this vulnerability in EPSS/KEV data suggests significant populations of unpatched or unpatchable legacy systems remain in production. |
| Exploit ScenarioDerived | Attacker crafts a malicious Office document (Word, Excel, PowerPoint) or RTF file embedding a specially formatted object designed to trigger the MSCOMCTL.OCX vulnerability. The file is delivered via spear-phishing email with convincing social engineering (invoice, job application, contract). When victim opens the document, the embedded ActiveX control is instantiated automatically, triggering system state corruption and executing attacker-controlled shellcode with the privileges of the logged-in user. Public POC availability makes weaponization straightforward. Exploitation was confirmed in targeted attacks beginning April 2012 and continues against unpatched systems per CISA KEV listing. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Apr 22, 2026
Remote code execution in Microsoft MSCOMCTL.OCX ActiveX controls allows unauthenticated attackers to execute arbitrary code via maliciously crafted Office documents, RTF files, or web pages. Actively exploited since April 2012 and confirmed in CISA KEV catalog. Despite being patched in 2012, EPSS score of 94.32% (100th percentile) indicates continued exploitation attempts against unpatched systems. Affects broad Microsoft product ecosystem including Office 2003-2010, SQL Server 2000-2008 R2, BizTalk, Commerce Server, Visual FoxPro, and Visual Basic 6.0 Runtime.
Earlier versions of this analysis (1)
Multiple ActiveX controls (ListView, ListView2, TreeView, TreeView2) in MSCOMCTL.OCX contain a memory corruption vulnerability enabling arbitrary code execution through malicious Office documents, widely weaponized by APT groups worldwide.
RemediationAI
Apply Microsoft Security Bulletin MS12-027 released April 2012 (https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-027) which provides patches for all affected Microsoft products. For Office products, upgrade to patched versions of Office 2003 (post-MS12-027), Office 2007 (post-MS12-027), or Office 2010 SP1 with MS12-027 applied, or migrate to modern supported Office versions (2016 or later) which are not affected. For SQL Server, apply the cumulative updates specified in MS12-027 or upgrade to SQL Server 2012 or later. Organizations unable to patch immediately should implement application whitelisting to prevent execution of untrusted ActiveX controls via registry modifications (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628} killbit). Block Office documents and RTF files from untrusted sources at email gateways and web proxies. Disable ActiveX controls in Internet Explorer via Group Policy for non-essential users. Note that killbit workarounds may break legitimate functionality in applications relying on MSCOMCTL.OCX controls. Legacy products like Visual Basic 6.0 Runtime and BizTalk Server 2002 require vendor-specific patching or decommissioning as they are no longer supported.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in four ActiveX controls (ListView, ListView2, TreeView, TreeView2) within MSCOMCTL.OCX, a shared component library used across Microsoft products for rendering common UI elements. The flaw is classified as CWE-94 (Code Injection) and allows attackers to trigger system state corruption when the ActiveX control parses specially crafted embedded objects. MSCOMCTL.OCX shipped with numerous Microsoft products from the late 1990s through 2010, creating extensive exposure. The ActiveX attack surface is particularly dangerous because these controls are automatically instantiated when processing Office documents, RTF files, or visiting web pages containing embedded objects, requiring no explicit user permission beyond opening the file. CPE data confirms impact spans Microsoft Office 2003 SP3 through 2010 SP1, Office Web Components 2003 SP3, SQL Server 2000 SP4 through 2008 R2, BizTalk Server 2002 SP1, Commerce Server 2002 SP4 through 2009 R2, Visual FoxPro 8.0 SP1 and 9.0 SP2, and Visual Basic 6.0 Runtime.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."
Executive ViewAI
CVE-2012-0158 is a critical remote code execution vulnerability in Microsoft MSCOMCTL.OCX that allows unauthenticated attackers to compromise systems through malicious Office documents or web content. With 94.3% exploit likelihood (EPSS), confirmed active exploitation, and broad impact across Office 2003-2010, SQL Server, and related Microsoft products, any unpatched instance represents immediate risk to organizational data and systems. Leadership must prioritize inventory and patching of affected Microsoft products across all endpoints and servers.
Apply vendor patch via Microsoft Security Bulletin MS12-027 (April 2012). If immediate patching is impossible: (1) Disable ActiveX controls in Office via Group Policy (HKEY_LOCAL_MACHINE\Software\Microsoft\Office\[version]\Common\Security\DisableAllActiveX); (2) Block .rtf file execution at email gateway and file server; (3) Implement network segmentation to isolate unpatched SQL Server and legacy systems; (4) Deploy endpoint detection and response (EDR) to monitor malicious Office process chains.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GitHub PoC