Microsoft · MSCOMCTL.OCX
CVE-2012-0158
Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
What it is
The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."
CISA: Microsoft MSCOMCTL.OCX contains an unspecified vulnerability that allows for remote code execution, allowing an attacker to take complete control of an affected system under the context of the current user.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
- Added to the CISA list
- November 3, 2021
- Published
- April 10, 2012
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- >99.9% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-94
- More details
- NVD · CVE.org · CISA
All references (12)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-027
- http://www.securitytracker.com/id?1026902
- http://www.securitytracker.com/id?1026899
- http://www.us-cert.gov/cas/techalerts/TA12-101A.html
- http://www.securitytracker.com/id?1026904
- http://www.securitytracker.com/id?1026903
- http://www.securitytracker.com/id?1026905
- http://opensources.info/comment-on-the-curious-case-of-a-cve-2012-0158-exploit-by-chris-pierce/
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15462
- http://www.securityfocus.com/bid/52911
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74372
- http://www.securitytracker.com/id?1026900
More exploited flaws from Microsoft
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 13, 2026 | Command Injection | Windows | High 8.8 | 9.8% |
| Sep 25, 2026 | Code Injection | SharePoint | High 8.8 | 8.2% |
| Sep 8, 2026 | Link Following | Windows | High 7.8 | 0.4% |
| Sep 8, 2026 | Heap-Based Buffer Overflow | Windows | High 7.8 | 0.4% |
| Aug 26, 2026 | Remote Code Execution | SQL Server | High 8.8 | 57% |
| Aug 18, 2026 | Double Free | Internet Key Exchange (IKE) Service Extensions | Critical 9.8 | 77% |
| Aug 18, 2026 | Weak Authentication | SharePoint | Critical 9.1 | 70% |
| Aug 11, 2026 | Windows Ancillary Function Driver for WinSock Use-After-Free | Windows Ancillary Function Driver for WinSock | High 7.0 | 0.3% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.