High severity · published Jul 10, 2012
CVE-2012-1854
Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
In wildKEV
7.8
CVSS
20.9%
EPSS
Yes
On KEV
Description
Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Visual Basic for Applications Insecure Library Loading Vulnerability," as exploited in the wild in July 2012.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)20.9% · higher than 98% of CVEs
Exploited in the wildYes
CISA KEVListed Apr 13, 2026
Federal remediation dueApr 27, 2026
Ransomware campaign useNot known
Affected products
Which versions
OF
Office · Microsoft
2003; 2007; 2007; 2010; 2010; 2010; +1 more · source: NVD
VB
Visual Basic For Applications · Microsoft
All versions, or not specified · source: NVD
VB
Visual Basic For Applications Sdk · Microsoft
All versions, or not specified · source: NVD
VB
Visual Basic for Applications (VBA) · Microsoft
All versions, or not specified · source: KEV
In the news
VulnerabilityHigh
[CISA KEV] CVE-2012-1854: Microsoft Visual Basic for Applications (VBA) - Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution.
VBVisual Basic for Applications (VBA)CVE-2012-1854
Apr 13, 2026·CISA KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-1854
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-1854
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
third-party-advisory
http://www.us-cert.gov/cas/techalerts/TA12-192A.html
vdb-entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14950
vendor-advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046
More from Office
9.8
CVE-2024-21413
Microsoft Outlook Remote Code Execution Vulnerability
9.8
CVE-2023-23397
Microsoft Outlook Elevation of Privilege Vulnerability
8.8
CVE-2024-38189
Microsoft Project Remote Code Execution Vulnerability
8.8
CVE-2023-35311
Microsoft Outlook Security Feature Bypass Vulnerability
8.8
CVE-2019-1297
Microsoft Excel Remote Code Execution Vulnerability