CVE-2012-0158

Imagine a “plug-in” component inside older Microsoft Office-related software that’s supposed to safely display certain list and tree views. This flaw lets an attacker trick the computer into running attacker code when a user opens a specially prepared file or visits a crafted page. If this succeeds, the attacker can take over the machine and do things like steal information, install ransomware, or disrupt operations.

This matters if you run Microsoft Office (and especially older Office service packs) or systems that include the related Office Web Components and the specific runtimes listed as affected (including certain SQL Server, BizTalk Server, Commerce Server, Visual Basic, and Visual FoxPro setups). Even though exploitation needs a user to be tricked (open/visit), it has been considered known exploited by CISA, so it’s not a purely theoretical risk. Treat it as a real risk on any internet-reachable workflow (email links, document downloads, web content) where an attacker can get a user to open a crafted web page, Office document, or .rtf file using these components.

This is RED because CISA has confirmed it as actively known to be exploited (added to the KEV list), and the remediation deadline has already passed. Attackers are using this bug to run code after tricking users with crafted content, which makes it a direct, practical threat to business systems that include the affected MSCOMCTL.OCX controls.

Confirm exposure

1. Identify where the affected component(s) are used:
   • Office desktops and any server roles that include the affected Office/Web components or legacy runtimes listed (Office/Office Web Components; the named SQL Server/BizTalk/Commerce/VBA/VFP environments).
2. Check patch status:
   • Confirm whether Microsoft’s security update MS12-027 is installed on those machines.
3. If you can’t easily inventory installed updates:
   • Use your standard software inventory/management tool (Windows update history, SCCM/Intune inventory, or IT asset logs) to determine whether MS12-027 (or an equivalent “remediated by MS12-027” state) is present.

Upgrade/patch plan

1. Apply the vendor fix:
   • Install the patch referenced by Microsoft bulletin MS12-027 (the vendor remediation for CVE-2012-0158).
2. Roll out broadly:
   • Patch all endpoints and any servers that may load/use MSCOMCTL.OCX through Office or the related application stacks (Office Web Components, SQL Server integrations, BizTalk/Commerce components, and legacy Visual Basic/Visual FoxPro runtimes).
3. Breaking-change note:
   • Microsoft security updates for this type of issue typically do not require application changes, but you should test quickly for any legacy app dependency on the affected control after patching.

If patching is delayed (temporary risk reduction)

1. Reduce chances of triggering the bug:
   • Restrict opening of unknown Office documents and .rtf files from email and the web.
2. Tighten browsing/download controls:
   • Block or limit untrusted web content paths where employees might open documents or visit links.
3. Monitor for suspicious activity:
   • Review endpoint logs for unexpected Office-related crashes/child-process launches after opening external documents (exact detection steps depend on your monitoring stack).

CISA timeline / due date

• CISA KEV due date for remediation: 2022-05-03 (already elapsed). Prioritize bringing all systems into the MS12-027 remediated state as soon as possible.

What to monitor after updating

• Re-check that MS12-027 remains installed after system updates/reimaging.
• Watch for repeated attempts involving Office/RTF content delivery (phishing campaigns) and for abnormal process behavior by Office components.

Severity and what it enables

• CVE-2012-0158 is rated high and allows remote execution of arbitrary code via the ActiveX controls in MSCOMCTL.OCX (ListView, ListView2, TreeView, TreeView2) used by the affected Microsoft Office-related components.

Mechanism / how it’s triggered

• The attacker delivers a crafted web site, Office document, or .rtf file that triggers corruption (described as “system state” corruption in the backstop) leading to arbitrary code execution.
• The findings state it does not require authentication, but user interaction is required (a user must be tricked into opening the crafted content).

Exploitation status (why RED)

• This is listed in CISA KEV (added 2021-11-03) with a required remediation due date of 2022-05-03.
• The backstop also references exploitation in the wild in April 2012, and the findings indicate the vulnerability is known exploited (via KEV), which takes precedence over predictions.

Patch

• Vendor remediation is provided in Microsoft bulletin MS12-027.

KEV meaning (in plain terms)

• “KEV” means CISA has assessed this vulnerability as being exploited in real-world attacks, so organizations should assume it is actively targeted and prioritize remediation.