CVE-2012-0158

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 99.98%
EPSS Percentile: 99.98%
CISA KEV: YES — Known Exploited Vulnerability

Description

The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 11-Apr-2012 04:55
Last Modified: 17-Jun-2026 06:36
EPSS Date: 2026-11-09
CWE: CWE-94

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:R /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2021-11-03
Remediation Due: 2022-05-03
Known Ransomware Campaign Use: Known
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2012-0158

CNA Products / Version Status

n/a · n/a Source: CNA · [email protected]
Default status: unknown

n/a — affected

Affected Products / Versions

microsoft / office Source: NVD CPE · affected
Version / affected range: 2003
cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*
microsoft / office Source: NVD CPE · affected
Version / affected range: 2007
cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*
microsoft / office Source: NVD CPE · affected
Version / affected range: 2007
cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*
microsoft / office Source: NVD CPE · affected
Version / affected range: 2010
cpe:2.3:a:microsoft:office:2010:-:*:*:*:*:x86:*
microsoft / office Source: NVD CPE · affected
Version / affected range: 2010
cpe:2.3:a:microsoft:office:2010:sp1:*:*:*:*:x86:*
microsoft / office_web_components Source: NVD CPE · affected
Version / affected range: 2003
cpe:2.3:a:microsoft:office_web_components:2003:sp3:*:*:*:*:*:*
microsoft / sql_server_2000 Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:microsoft:sql_server_2000:-:sp4:*:*:*:*:*:*
microsoft / sql_server_2005 Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:microsoft:sql_server_2005:-:sp4:*:*:*:*:*:*
microsoft / sql_server_2008 Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:microsoft:sql_server_2008:-:sp2:*:*:*:*:*:*
microsoft / sql_server_2008 Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:microsoft:sql_server_2008:-:sp3:*:*:*:*:*:*
microsoft / sql_server_2008 Source: NVD CPE · affected
Version / affected range: r2
cpe:2.3:a:microsoft:sql_server_2008:r2:-:*:*:*:*:*:*
microsoft / sql_server_2008 Source: NVD CPE · affected
Version / affected range: r2
cpe:2.3:a:microsoft:sql_server_2008:r2:sp1:*:*:*:*:*:*
microsoft / biztalk_server Source: NVD CPE · affected
Version / affected range: 2002
cpe:2.3:a:microsoft:biztalk_server:2002:sp1:*:*:*:*:*:*
microsoft / commerce_server Source: NVD CPE · affected
Version / affected range: 2002
cpe:2.3:a:microsoft:commerce_server:2002:sp4:*:*:*:*:*:*
microsoft / commerce_server Source: NVD CPE · affected
Version / affected range: 2007
cpe:2.3:a:microsoft:commerce_server:2007:sp2:*:*:*:*:*:*
microsoft / commerce_server_2009 Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:microsoft:commerce_server_2009:-:*:*:*:*:*:*:*
microsoft / commerce_server_2009 Source: NVD CPE · affected
Version / affected range: r2
cpe:2.3:a:microsoft:commerce_server_2009:r2:*:*:*:*:*:*:*
microsoft / visual_basic Source: NVD CPE · affected
Version / affected range: 6.0
cpe:2.3:a:microsoft:visual_basic:6.0:*:*:*:*:*:*:*
microsoft / visual_foxpro Source: NVD CPE · affected
Version / affected range: 8.0
cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:*
microsoft / visual_foxpro Source: NVD CPE · affected
Version / affected range: 9.0
cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:*

References

Last enrichment sync: 10-Nov-2026 21:01
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

[CVE ] Exploited vulnerabilities used as initial access vectors – CVE-2025-15556, CVE-2012-0158, and 7 more CVEs (e.g., CVE-2018-0802, CVE-2017-11882). Lotus Blossom Profile Traces Shift From Phishing to Supply-Chain Espionage

CVE (9)

Malware (5)

Threat Actors (5)

MITRE ATT&CK (15)

Vendors (2)

Products (6)

Tools (7)

Industries (5)

Countries (10)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.