{"schemaVersion":3,"id":"CVE-2012-0158","aliases":[],"status":"published","duplicateOf":null,"title":"Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability","description":"The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers \"system state\" corruption, as exploited in the wild in April 2012, aka \"MSCOMCTL.OCX RCE Vulnerability.\"","dates":{"published":"2012-04-10T21:00:00.000Z","modified":"2025-10-22T00:05:47.862Z","reserved":null,"kevAdded":["2021-11-03T00:00:00.000Z"],"kevDue":["2022-05-03T00:00:00.000Z"]},"cvss":{"headline":{"score":9.3,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9.3,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.99976,"percentile":0.99979,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.99976},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99976,"percentile":0.99979}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99976,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99976,"percentile":0.99979}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2022-05-03T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability","description":"Microsoft MSCOMCTL.OCX contains an unspecified vulnerability that allows for remote code execution, allowing an attacker to take complete control of an affected system under the context of the current user.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2012-0158","label":"nvd.nist.gov/vuln/detail/CVE-2012-0158"}],"vendor":"Microsoft","product":"MSCOMCTL.OCX","ransomware":true,"ransomwareUse":"Known","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2022-05-03T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability","description":"Microsoft MSCOMCTL.OCX contains an unspecified vulnerability that allows for remote code execution, allowing an attacker to take complete control of an affected system under the context of the current user.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2012-0158","label":"nvd.nist.gov/vuln/detail/CVE-2012-0158"}],"vendor":"Microsoft","product":"MSCOMCTL.OCX","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"known","sources":["cisa"]},"exploits":[{"id":"18780","name":"Microsoft Windows - MSCOMCTL ActiveX Buffer Overflow (MS12-027) (Metasploit)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/18780","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/18780.rb","codes":["CVE-2012-0158","OSVDB-81125","MS12-027"]},"metasploit":null},{"id":"MSF_EXPLOIT_WINDOWS_FILEFORMAT_MS12_027_MSCOMCTL_BOF","name":"MS12-027 MSCOMCTL ActiveX Buffer Overflow","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/fileformat/ms12_027_mscomctl_bof.rb","maturity":"poc","reliabilityScore":0.3333333333333333,"verified":false,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/fileformat/ms12_027_mscomctl_bof","rank":"200","rankName":"average","postAuth":false,"check":false,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}}],"exploitCount":2,"weaknesses":[{"id":"CWE-94","name":"Improper Control of Generation of Code ('Code Injection')","description":"The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/94.html"}],"affected":[{"vendor":"microsoft","product":"biztalk_server","name":"biztalk server","label":"biztalk_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2002:sp1","noFixRecorded":false,"fixedIn":null}],"versionsText":"2002:sp1","eol":null,"hubHref":"/vendor/microsoft/biztalk_server"},{"vendor":"microsoft","product":"commerce_server","name":"commerce server","label":"commerce_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2002:sp4","noFixRecorded":false,"fixedIn":null},{"text":"2007:sp2","noFixRecorded":false,"fixedIn":null}],"versionsText":"2002:sp4 | 2007:sp2","eol":null,"hubHref":"/vendor/microsoft/commerce_server"},{"vendor":"microsoft","product":"commerce_server_2009","name":"commerce server 2009","label":"commerce_server_2009","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null},{"text":"r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"na | r2","eol":null,"hubHref":"/vendor/microsoft/commerce_server_2009"},{"vendor":"microsoft","product":"office","name":"office","label":"office","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2003:sp3","noFixRecorded":false,"fixedIn":null},{"text":"2007:sp2","noFixRecorded":false,"fixedIn":null},{"text":"2007:sp3","noFixRecorded":false,"fixedIn":null},{"text":"2010","noFixRecorded":false,"fixedIn":null},{"text":"2010:sp1","noFixRecorded":false,"fixedIn":null}],"versionsText":"2003:sp3 | 2007:sp2 | 2007:sp3 | 2010 | 2010:sp1","eol":{"isEol":true,"eolDate":"2020-10-13T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"2010","label":"2010 SP2","eolFrom":"2020-10-13T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"office","label":"Microsoft Office","category":"app"}},"hubHref":"/vendor/microsoft/office"},{"vendor":"microsoft","product":"office_web_components","name":"office web components","label":"office_web_components","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2003:sp3","noFixRecorded":false,"fixedIn":null}],"versionsText":"2003:sp3","eol":null,"hubHref":"/vendor/microsoft/office_web_components"},{"vendor":"microsoft","product":"sql_server_2000","name":"sql server 2000","label":"sql_server_2000","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/sql_server_2000"},{"vendor":"microsoft","product":"sql_server_2005","name":"sql server 2005","label":"sql_server_2005","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/sql_server_2005"},{"vendor":"microsoft","product":"sql_server_2008","name":"sql server 2008","label":"sql_server_2008","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null},{"text":"r2","noFixRecorded":false,"fixedIn":null},{"text":"r2:sp1","noFixRecorded":false,"fixedIn":null}],"versionsText":"na | r2 | r2:sp1","eol":null,"hubHref":"/vendor/microsoft/sql_server_2008"},{"vendor":"microsoft","product":"visual_basic","name":"visual basic","label":"visual_basic","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"6.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.0","eol":null,"hubHref":"/vendor/microsoft/visual_basic"},{"vendor":"microsoft","product":"visual_foxpro","name":"visual foxpro","label":"visual_foxpro","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"8.0:sp1","noFixRecorded":false,"fixedIn":null},{"text":"9.0:sp2","noFixRecorded":false,"fixedIn":null}],"versionsText":"8.0:sp1 | 9.0:sp2","eol":null,"hubHref":"/vendor/microsoft/visual_foxpro"}],"affectedCount":10,"eol":{"hasEol":true,"count":1},"references":[{"url":"http://www.securitytracker.com/id?1026902","label":"www.securitytracker.com/id?1026902","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id?1026899","label":"www.securitytracker.com/id?1026899","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA12-101A.html","label":"www.us-cert.gov/cas/techalerts/TA12-101A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://www.securitytracker.com/id?1026904","label":"www.securitytracker.com/id?1026904","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id?1026903","label":"www.securitytracker.com/id?1026903","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id?1026905","label":"www.securitytracker.com/id?1026905","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"http://opensources.info/comment-on-the-curious-case-of-a-cve-2012-0158-exploit-by-chris-pierce/","label":"opensources.info/comment-on-the-curious-case-of-a-cve-2012-0158-exploit-by-chris-pierce/","hostname":"opensources.info","tags":["X Refsource MISC","Broken Link"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-027","label":"docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-027","hostname":"docs.microsoft.com","tags":["Vendor Advisory","X Refsource MS","Patch"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15462","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15462","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL","Broken Link"]},{"url":"http://www.securityfocus.com/bid/52911","label":"www.securityfocus.com/bid/52911","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/74372","label":"exchange.xforce.ibmcloud.com/vulnerabilities/74372","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id?1026900","label":"www.securitytracker.com/id?1026900","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0158","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0158","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2012-04-10T21:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2021-11-03T00:00:00.000Z","label":"Added to CISA KEV","detail":"Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-05-03T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-22T00:05:47.862Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T17:24:19.277Z","stale":false,"partial":false}}