CVE-2012-0158highunder attackransomwareCWE-94

CVE-2012-0158

Published · Updated

Follow this CVE+ Monitor MSCOMCTL.OCX

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 9 threat group(s) use it.

ssvc Actcvss 8.8epss 100%
from disclosure to weapon15 days
Published on NVDApr 10
1st PoC+15d
metasploitApr 10
CISA KEV+3494d
Who exploits it — 9

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / Stateadmin@338🇨🇳 MITRE ATT&CK
APT / StateAoqin Dragon🇨🇳 MITRE ATT&CK
APT / StateAPT12🇨🇳 MITRE ATT&CK
APT / StateAPT41🇨🇳 MITRE ATT&CK
APT / StateBITTER🇨🇳 MITRE ATT&CK
APT / StateBlackTech🇨🇳 MITRE ATT&CK
APT / StateInception🇷🇺 MITRE ATT&CK
APT / StateTransparent Tribe🇮🇳 MITRE ATT&CK
APT / StateTropic Trooper MITRE ATT&CK
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

A flaw in Microsoft's common controls (ListView, TreeView, and similar components) allows attackers to run malicious code on your computer through a rigged website, Office document, or file. This happens because the controls don't properly validate certain inputs, letting attackers corrupt system memory.

Technical detail

CVE-2012-0158 is an arbitrary code execution vulnerability in MSCOMCTL.OCX ActiveX controls (ListView, TreeView variants) affecting multiple Microsoft products. The vulnerability exploits improper input validation that leads to memory corruption; attack vectors include malicious web pages, Office documents, or RTF files. Successful exploitation grants remote code execution with user privileges, requiring no authentication or special preconditions beyond user interaction.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.