CVE-2012-0158

The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."

First PoC 2012-04-25
4808 days →Metasploit 2025-06-23
481 days →First cited attacker 2026-10-17

Exploited in the wild: Yesadded 2021-11-03 · due 2022-05-03 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast: 100.0%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Internet exposure: not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

2 known · links only

Metasploit1

MS12-027 MSCOMCTL ActiveX Buffer Overflow ↗
This module exploits a stack buffer overflow in MSCOMCTL.OCX. It uses a malicious RTF to embed the specially crafted MSComctlLib.ListViewCtrl.2 Control as exploited in the wild on April 2012. This module targets Office 2007 and Office 2010 targets. The DEP/ASLR bypass on Office 2010 is done with the Ikazuchi ROP chain proposed by Abysssec. This chain uses "msgr3en.dll", which will load after office got load, so the malicious file must
ruby · seen 2026-10-18

Exploit-DB1

Microsoft Windows - MSCOMCTL ActiveX Buffer Overflow (MS12-027) (Metasploit) ↗
created 2012-04-25

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Tied by cited sources to

APT28
1. “CVE-2012-0158: ActiveX Corruption Vulnerability for Microsoft Office”
  cited as exploiting · named nearby · source: us-cert.gov ↗ · 2026-10-17
BRONZE HIGHLAND
1. “•Exploit vulnerabilities (CVE-2012-0158) –Archive file –VB script vulnerability (CVE-2018-8174) •Toolsets –MgBot –KsRemoteAndroid Rat –Cobalt Strike Evasive Panda”
  cited as exploiting · source: vb2020.vblocalhost.com ↗ · 2026-10-17
APT10
1. “We found Stone Panda Poison Ivy samples delivered with the same CVE-2012-0158 exploits, dropping iph.bat and iExplorer.exe”
  cited as exploiting · source: media.kasperskycontenthub.com ↗ · 2026-10-17
Naikon
1. “For years, Naikon downloaders/backdoors were delivered to victim systems with kit- produced CVE-2012-0158 spear-phish.”
  cited as exploiting · source: media.kasperskycontenthub.com ↗ · 2026-10-17
2. “The Naikon group used mostly spear-phished documents for the attacks, with CVE-2012-0158 exploits that dropped the group’s signature backdoor.”
  cited as exploiting · source: securelist.com ↗ · 2026-10-17
3. “This bait “document”, or email attachment, appears to be a standard Word document, but is in fact an CVE-2012-0158 exploit, an executable with a double extension, or an executable with an RTLO filename, so it can execute code without the user’s knowledge or consent.”
  cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17
4. “This bait “document”, or email attachment, appears to be a standard Word document, but is in fact an CVE-2012-0158 exploit, an executable with a double extension, or an executable with an RTLO filename, so it can execute code without the user’s knowledge or consent.”
  cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17
QUILTED TIGER
1. “We have seen this dropped by an RTF exploiting CVE-2012-0158 under the name "DPP_INDIA_2016.doc"”
  cited as used in a campaign · named nearby · source: forcepoint.com ↗ · 2026-10-17
APT23
1. “The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors. This matches with known Tactics, Techniques, and Procedures (TTPs) for Tropic Trooper”
  cited as used in a campaign · source: researchcenter.paloaltonetworks.com ↗ · 2026-10-17
2. “The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors. This matches with known Tactics, Techniques, and Procedures (TTPs) for Tropic Trooper”
  cited as exploiting · source: researchcenter.paloaltonetworks.com ↗ · 2026-10-17
3. “Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
4. “The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors. This matches with known Tactics, Techniques, and Procedures (TTPs) for Tropic Trooper”
  cited as exploiting · source: unit42.paloaltonetworks.com ↗ · 2026-10-17
Inception Framework
1. “In August 2014, some of our users observed targeted attacks with a variation of CVE-2012-0158 and an unusual set of malware.”
  cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17
APT41
1. “APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
BlackTech
1. “BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
LOTUS PANDA
1. “While this particular actor effectively used their almost worn out CVE-2012-0158 exploits in the past, Spring Dragon employs more involved and creative intrusive activity as well.”
  cited as exploiting · source: securelist.com ↗ · 2026-10-17
2. “The group’s spearphish toolset includes PDF exploits, Adobe Flash Player exploits, and the common CVE-2012-0158 Word exploits including those generated from the infamous “Tran Duy Linh” kit.”
  cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17
Operation C-Major
1. “Transparent Tribe has crafted malicious files to exploit CVE-2012-0158 and CVE-2010-3333 for execution.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
TEMPER PANDA
1. “admin@338 has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
GOBLIN PANDA
1. “Distribution of infected samples are often used by attackers such as Goblin Panda through weaponized Microsoft Office documents containing malicious macros, or by exploiting known vulnerabilities—most recently CVE-2012-0158 and CVE-2017-11882.”
  cited as exploiting · source: fortinet.com ↗ · 2026-10-17
2. “When opened, both documents use CVE-2012-0158 exploit code to drop malicious files associated with a previously identified side-loading malware implant, tracked as QCRat by CrowdStrike Falcon® Intelligence™.”
  cited as used in a campaign · named nearby · source: crowdstrike.com ↗ · 2026-10-17
Aoqin Dragon
1. “During 2012 to 2015, Aoqin Dragon relied heavily on CVE-2012-0158 and CVE-2010-3333 to compromise their targets.”
  cited as exploiting · source: sentinelone.com ↗ · 2026-10-17
2. “Aoqin Dragon has exploited CVE-2012-0158 and CVE-2010-3333 for execution against targeted systems.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
ModifiedElephant
1. “Observed lure documents repeatedly made use of CVE-2012-0158 , CVE-2014-1761 , CVE-2013-3906 , CVE-2015-1641 exploits to drop and execute their malware of choice.”
  cited as exploiting · named nearby · source: sentinelone.com ↗ · 2026-10-17
Scarlet Mimic
1. “We have identified spear phishing documents from Scarlet Mimic exploiting the following vulnerabilities. CVE-2012-0158”
  cited as exploiting · source: unit42.paloaltonetworks.com ↗ · 2026-10-17
2. “We have identified spear phishing documents from Scarlet Mimic exploiting the following vulnerabilities. CVE-2012-0158”
  cited as exploiting · source: researchcenter.paloaltonetworks.com ↗ · 2026-10-17
APT12
1. “APT12 has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities (CVE-2009-3129, CVE-2012-0158)”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
GreenSpot
1. “The traditional CVE-2012-0158 exploit format is mainly RTF, but “GreenSpot” group uses the MHT format, which can also trigger vulnerabilities, and can evade multiple antivirus software.”
  cited as exploiting · source: antiy.net ↗ · 2026-10-17
Roaming tiger
1. “As described in earlier reports on “Roaming Tiger”, the attack observed in August 2015 used weaponized exploit documents that leave Russian language decoy document files after infecting the system. The files exploit the well-known Microsoft Office vulnerability, CVE-2012-0158, to execute malicious code in order to take control of the targeted systems.”
  cited as used in a campaign · source: unit42.paloaltonetworks.com ↗ · 2026-10-17
2. “Use of RTF vulnerabilities (CVE-2012-0158 and CVE-2014-1761)”
  cited as exploiting · named nearby · source: 2014.zeronights.org ↗ · 2026-10-17

Each actor is cited by the quoted source, linked under the quote. A citation is that source's claim, not our confirmation.

References

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.

Signals

Exploits

Metasploit1

Exploit-DB1

On the wire

Watch this one?