What is the CVSS score of CVE-2012-1876?

CVE-2012-1876 has a CVSS 2.0 base score of 9.3 (Critical). CVSS vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. EPSS exploitation probability: 87.3%.

Is there a public PoC exploit available for CVE-2012-1876?

Yes, a public proof-of-concept exploit is available for CVE-2012-1876. Prioritise patching immediately. EPSS: 87.3%.

Internet Explorer CVE-2012-1876

CRITICAL

Code Injection (CWE-94)

2012-06-12 secure@microsoft.com

Buffer Overflow Code Injection Microsoft RCE Internet Explorer

9.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:M/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:C/I:C/A:C

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Jun 12, 2012 - 22:55 cve.org

CRITICAL 9.3

DescriptionCVE.org

Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka "Col Element Remote Code Execution Vulnerability," as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.

AnalysisAI

Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.3%.

Technical ContextAI

This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka "Col Element Remote Code Execution Vulnerability," as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. Affected products include: Microsoft Internet Explorer. Version information: through 9.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.