CVE-2012-1854

CVE-2012-1854 is a high-severity (CVSS 7.8) vulnerability in Microsoft Visual Basic for Applications (VBA). CISA added it to the Known Exploited Vulnerabilities catalog on April 13, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 27, 2026. CISA does not currently list it as used in ransomware campaigns. Microsoft has 390 vulnerabilities in the KEV catalog, 117 of them linked to ransomware.

Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Visual Basic for Applications Insecure Library Loading Vulnerability," as exploited in the wild in July 2012.

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• http://www.us-cert.gov/cas/techalerts/TA12-192A.html
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14950
• http://www.us-cert.gov/cas/techalerts/TA12-192A.html
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14950
• https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2012/ms12-046
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1854