CVE-2012-1854: microsoft office +2 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2012-1854

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 20,9%

Kerentanan Untrusted Search Path pada microsoft office, microsoft visual basic for applications +1 lainnya. Skor CVSS 3.1 7.8 (High) menurut CISA ADP. Masuk katalog KEV CISA pada 13 April 2026, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Visual Basic for Applications Insecure Library Loading Vulnerability," as exploited in the wild in July 2012.

Rincian

Terbit di NVD: 10 Juli 2012
Terakhir diubah: 16 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.8 (High), sumber CISA ADP
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-426: Untrusted Search Path
EPSS (30 hari): 20,9% peluang dieksploitasi; lebih tinggi dari 97,5% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
Masuk KEV: 13 April 2026
Tenggat CISA: 27 April 2026 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
microsoft	office	Versi 2003 sp3
microsoft	office	Versi 2007 sp2
microsoft	office	Versi 2007 sp3
microsoft	office	Versi 2010
microsoft	office	Versi 2010 sp1
microsoft	visual basic for applications	Semua versi
microsoft	visual basic for applications sdk	Semua versi

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046 mitigasi · advisory vendor
https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2012/ms12-046 mitigasi · advisory vendor
http://www.us-cert.gov/cas/techalerts/TA12-192A.html pemerintah AS
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1854 pemerintah AS
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14950 broken link

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.