CVE-2012-1854highunder attackCWE-426

CVE-2012-1854

Published · Updated

Follow this CVE+ Monitor Visual Basic for Applications

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

56Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has an official Brazilian government alert.

ssvc Actcvss 7.8epss 21%
from disclosure to weapon
Published on NVDJul 10
CISA KEV+5025d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 29/2026Vulnerabilidade no Visual Basic for Applications (VBA)read on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2026-04-27

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Microsoft Office and Visual Basic for Applications load DLL files from the current folder without checking if they're trustworthy, allowing someone to place a malicious DLL in the same folder as a Word document to gain control when the document is opened.

Technical detail

DLL search path hijacking vulnerability in VBE6.dll (CWE-426) affecting Office 2003-2010 and VBA SDK; local attackers can plant malicious DLLs in the working directory where Office files reside, leading to arbitrary code execution with user privileges through insecure library loading without verification of DLL source.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Visual Basic for Applications Insecure Library Loading Vulnerability," as exploited in the wild in July 2012.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a