ZeroDay Findings
Sign inSign up

Findings

CVE-2012-1854

Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability

Published Jul 10, 2012 · updated Jun 16, 2026 · Microsoft Visual Basic for Applications (VBA)

Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Visual Basic for Applications Insecure Library Loading Vulnerability," as exploited in the wild in July 2012.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 10, 2012 · Catalog

    Detected

    Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Visual Basic for App

  2. Apr 13, 2026 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Apr 27, 2026 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Visual Basic for App

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Apr 27, 2026

Affected

  • cpe microsoft/office2003
  • cpe microsoft/office2007
  • cpe microsoft/office2010
  • cpe microsoft/visual basic for applicationsversion unspecified
  • vendor Microsoft Visual Basic for Applications (VBA)version unspecified

Sources

  • CISA KEVCVE-2012-1854

    Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution.

    cisa.gov
  • CVE.orgCVE-2012-1854

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2012-1854

    30-day exploitation probability 20.9%

    first.org
  • NIST NVDCVE-2012-1854

    Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DL

    nvd.nist.gov

References