{"id":"CVE-2012-0158","published":"2012-04-10T21:55:01Z","modified":"2026-06-16T23:36:48Z","title":"Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability","vendor":"Microsoft","product":"MSCOMCTL.OCX","tier":"core","eol":null,"description":{"text":"The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers \"system state\" corruption, as exploited in the wild in April 2012, aka \"MSCOMCTL.OCX RCE Vulnerability.\"","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is in the ListView, ListView2, TreeView, and TreeView2 ActiveX controls within Microsoft's MSCOMCTL.OCX Common Controls component, which ships with several Microsoft products including Office, SQL Server, BizTalk Server, Commerce Server, Visual FoxPro, and the Visual Basic 6.0 Runtime. An attacker can execute arbitrary code by getting a user to open a crafted web page, Office document, or .rtf file that corrupts system state, which requires user interaction and no prior authentication.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:06Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99976,"percentile":0.99979,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2012-0158","provenance":"source"},"vulncheckKev":{"dateAdded":"2012-01-01","exploitedFirstSeen":"2012-01-01","ransomware":true,"evidence":[{"url":"https://web.archive.org/web/20120907091804/http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf","date":"2012-01-01"},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-0158","date":"2012-04-10"},{"url":"https://cybersecurity.att.com/blogs/labs-research/msupdater-trojan-found-using-cve-2012-0158-space-and-missile-defense-conference","date":"2012-04-23"},{"url":"https://securelist.com/red-october-diplomatic-cyber-attacks-investigation/36740/","date":"2013-01-14"},{"url":"https://kung_foo.keybase.pub/papers_and_presentations/Unveiling_an_Indian_Cyberattack_Infrastructure.pdf","date":"2013-05-01"},{"url":"https://securelist.com/nettraveler-is-running-red-star-apt-attacks-compromise-high-profile-victims/35936/","date":"2013-06-04"},{"url":"https://blog.rapid7.com/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india/","date":"2013-06-07"},{"url":"https://securelist.com/the-icefog-apt-a-tale-of-cloak-and-three-daggers/57331/","date":"2013-09-25"},{"url":"https://www.fireeye.com/blog/threat-research/2013/10/know-your-enemy-tracking-a-rapidly-evolving-apt-actor.html","date":"2013-10-31"},{"url":"https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-operation-pawn-storm.pdf","date":"2014-01-01"}],"evidenceTotal":85,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"http://opensources.info/comment-on-the-curious-case-of-a-cve-2012-0158-exploit-by-chris-pierce/","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/bid/52911","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1026899","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1026900","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1026902","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1026903","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1026904","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1026905","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA12-101A.html","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-027","tags":["Patch","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/74372","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15462","tags":["Broken Link"]},{"url":"http://opensources.info/comment-on-the-curious-case-of-a-cve-2012-0158-exploit-by-chris-pierce/","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/bid/52911","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1026899","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1026900","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1026902","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1026903","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1026904","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1026905","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA12-101A.html","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-027","tags":["Patch","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/74372","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15462","tags":["Broken Link"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0158","tags":["US Government Resource"]}],"techniques":[{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Malicious web site drives code execution","mappingType":"uncategorized","evidence":[{"from":"description","quote":"allow remote attackers to execute arbitrary code via a crafted (a) web site","start":429,"end":504}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"needs user interaction; not a public-facing exploit"},{"id":"T1491","name":"Defacement","tactics":["impact"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1546","name":"Event Triggered Execution","tactics":["persistence","privilege-escalation"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1554","name":"Compromise Host Software Binary","tactics":["persistence"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1565","name":"Data Manipulation","tactics":["impact"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping","dataset-annotation"],"basisDetail":"claude-haiku-5-5: Client application executes attacker code; AnnoCTR expert entity-linking label (train split)","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allow remote attackers to execute arbitrary code via a crafted","start":429,"end":491},{"reportId":"SRC-ceefdd3b373149b188b8","quote":"o    CVE-2012-0158 [2]","start":6457,"end":6479},{"reportId":"SRC-ceefdd3b373149b188b8","quote":"o    CVE-2012-0158 [2]\r\no    CVE-2017-0199 [3]","start":6457,"end":6503},{"reportId":"SRC-ceefdd3b373149b188b8","quote":"o    CVE-2012-0158 [2]\r\no    CVE-2017-0199 [3]\r\no    CVE-2017-8759 [5]","start":6457,"end":6527}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-ceefdd3b373149b188b8","title":"Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures)","publisher":"Lab52 / S2 Grupo","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/lab52_2019-05-30_leviathan-geostrategy-and-ttp-technical.txt","date":"2019-05-30","mentions":[{"quote":"o    CVE-2012-0158 [2]","start":6457,"end":6479},{"quote":"[2] <http://cve.circl.lu/cve/CVE-2012-0158>","start":13630,"end":13673}]},{"id":"SRC-92352da397787b4045e8","title":"The Trail of BlackTech’s Cyber Espionage Campaigns","publisher":"trendmicro.com","url":"https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html","date":"2017-06-22","mentions":[{"quote":"CVE-2012-0158, patched by Microsoft last April, 2012","start":2018,"end":2070}]},{"id":"SRC-c54e596f4a0392564b03","title":"BITTER: A Targeted Attack Against Pakistan | Forcepoint BITTER: a targeted attack against Pakistan","publisher":"forcepoint.com","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan","date":"2016-10-21","mentions":[{"quote":"The campaign predominantly used the older, relatively popular Microsoft Office exploit, CVE-2012-0158, in order to download and execute a RAT binary from a website.","start":604,"end":768},{"quote":"Other attachment filenames they used that also contained the CVE-2012-0158 exploit are as follows:","start":1000,"end":1098}]},{"id":"SRC-62aa640e098a9c9dc263","title":"Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists","publisher":"unit42.paloaltonetworks.com","url":"https://unit42.paloaltonetworks.com/scarlet-mimic-years-long-espionage-targets-minority-activists/","date":"2016-01-24","mentions":[{"quote":"- CVE-2012-0158","start":8951,"end":8966}]},{"id":"SRC-eb7353d6a948899d0c6a","title":"Operation Tropic Trooper: Relying on Tried-and-Tested Flaws to Infiltrate Secret Keepers","publisher":"documents.trendmicro.com","url":"https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf","date":null,"mentions":[{"quote":"CVE-2010-3333 and CVE-2012-0158—to infiltrate","start":4964,"end":5009},{"quote":"2010-3333 and CVE-2012-\r\n0158.","start":6177,"end":6207}]},{"id":"SRC-aae333eb08b39b689148","title":"It’s Parliamentary: KeyBoy and the Targeting of the Tibetan Community","publisher":"citizenlab.ca","url":"https://citizenlab.ca/research/parliament-keyboy/","date":null,"mentions":[{"quote":"The first attempt leveraged an old vulnerability in the parsing of Rich-text-format (.rtf) files (CVE-2012-0158).","start":6045,"end":6158},{"quote":"The email attachment is a .rtf document containing a dropper, delivered using an exploit designed to leverage CVE-2012-0158, a vulnerability in the way that Microsoft Word handles .rtf files.","start":7479,"end":7670},{"quote":"The two .rtf vulnerabilities targeted in these exploitation attempts, CVE-2012-0158 and CVE-2015-1641, are among a set of four .rtf vulnerabilities discussed in recent reporting from researchers at Arbor Networks.","start":11825,"end":12038},{"quote":"The researchers describe the presumed existence of an exploit document ‘builder’ designed to selectively weaponize .rtf files using four older, patched, vulnerabilities: CVE-2012-0158, CVE-2012-1856, CVE-2015-1641, and CVE-2015-1770.","start":12042,"end":12275},{"quote":"This .rtf document, also exploiting CVE-2012-0158, was submitted to VirusTotal in March 2016.","start":36603,"end":36696}]},{"id":"SRC-a55a5c8cf0c00663d69b","title":"Eset gelsemium","publisher":"web-assets.esetstatic.com","url":"https://web-assets.esetstatic.com/wls/2021/06/eset_gelsemium.pdf","date":null,"mentions":[{"quote":"spearphishing with attachments exploiting a then-old vulnerability in Microsoft Office (CVE-2012-0158)","start":2829,"end":2931},{"quote":"a Microsoft Office vulnerability (CVE-2012-0158) .","start":4589,"end":4639},{"quote":"vulnerabilities for execution, such as CVE-2012-0158","start":31966,"end":32018}]},{"id":"SRC-93c55e10ab45afc37c85","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf","date":null,"mentions":[{"quote":" CVE-2012-0158 is a remote code execution in Windows Common Controls","start":111416,"end":111485},{"quote":"CVE-2012-0158","start":112208,"end":112221},{"quote":"CVE-2012-0158, 62","start":261315,"end":261332}]},{"id":"SRC-886ee8388cf5400c59a7","title":"TheNaikonAPT MsnMM1","publisher":"media.kasperskycontenthub.com","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf","date":null,"mentions":[{"quote":"produced CVE-2012-0158 spear-phish.","start":5080,"end":5115},{"quote":"compromised victim systems using common spear-phishing techniques, such as cve-\r\n2012-0158 exploit attachments, attachments altered with RTLO techniques, and a com-","start":7057,"end":7221},{"quote":"generates CVE-2012-0158 exploits embedded with arbitrary backdoors for spear-","start":8260,"end":8337},{"quote":"the same CVE-2012-0158 exploits, dropping iph.bat and iExplorer.exe, and running","start":9056,"end":9136},{"quote":"It was used across this group and others for building CVE-2012-0158 files,","start":9294,"end":9368}]},{"id":"SRC-619721166ae9d9d7fdcd","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf","date":null,"mentions":[{"quote":"CVE-2012-0158","start":92480,"end":92493},{"quote":"CVE-2012-0158, 52","start":238080,"end":238097}]},{"id":"SRC-4985d05a759f610274db","title":"Operation Transparent Title","publisher":"proofpoint.com","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf","date":null,"mentions":[{"quote":"exploit: CVE-2012-0158","start":1709,"end":1731},{"quote":"In this incident, the attachment was a weaponized RTF document utilizing CVE-2012-0158 to drop an embedded,","start":2053,"end":2160},{"quote":"Type: Exploit,CVE-2012-0158,Embedded Payload","start":5017,"end":5061},{"quote":"get additional colonels posts\r\nLink: hxxp://intribune.blogspot[.]com/2015/11/army-air-defenceengineers-and-signal-to.html\r\nMalicious Document Location: hxxp://birthdaywisheszone[.]com/pml/army-air-defenceengineers-and-signal.doc\r\nDocument: 68773f362d5ab4897d4ca217a9f53975\r\nType: Exploit,CVE-2012-0158,Embedded","start":6685,"end":6995},{"quote":"Para-Military Forces Personnel Plots Scheme 2016\r\nLink: hxxp://intribune[.]blogspot[.]com/2015/07/awho-defence-and-para-military-forces.html\r\nMalicious Document Location: hxxp://bbmsync2727[.]com/upd/AWHO-Upcoming-Projects.doc\r\nDocument: 1f82e509371c1c29b40b865ba77d091a\r\nType: Exploit,CVE-2012-0158,Embedded","start":8498,"end":8806}]},{"id":"SRC-4086581233078037072f","title":"REPORT ON THE INVESTIGATION INTO THE MALWARE-AS-A-SERVICE","publisher":"media.kasperskycontenthub.com","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07195002/KL_AdwindPublicReport_2016.pdf","date":null,"mentions":[{"quote":"(MD5 1f14bd3706f22ae03b42510940692c50) with Exploit.CVE-2012-0158.","start":40239,"end":40305}]},{"id":"SRC-37b543b4cde4966b286b","title":"MONSOON – ANALYSIS OF AN APT CAMPAIGN","publisher":"forcepoint.com","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf","date":null,"mentions":[{"quote":"CVE-2012-0158 Microsoft BizTalk Server Windows Common Controls (MSCOMCTL.OCX)","start":27161,"end":27238},{"quote":"We have seen this dropped by an RTF exploiting CVE-2012-0158","start":30739,"end":30799}]},{"id":"SRC-34d3d0da0eb12f3882ef","title":"Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years","publisher":"sentinelone.com","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/","date":null,"mentions":[{"quote":"During 2012 to 2015, Aoqin Dragon relied heavily on CVE-2012-0158 and CVE-2010-3333 to compromise their targets.","start":2051,"end":2163}]},{"id":"SRC-09d89e3efd27d92dba5c","title":"Operation Cloud Hopper: Technical Annex","publisher":"pwc.co.uk","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf","date":null,"mentions":[{"quote":"Taiwan president election watching group schedule”.2 Once the spreadsheet is opened, CVE-\r\n2012-0158 is exploited and a file called 6EC5.tmp is dropped in the %TEMP% folder.","start":7948,"end":8121}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2012-0196","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2012-0196","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":18780,"url":"https://www.exploit-db.com/exploits/18780","title":"Microsoft Windows - MSCOMCTL ActiveX Buffer Overflow (MS12-027) (Metasploit)","type":"remote","platform":"windows","date":"2012-04-25","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2012-04-25"},"pocGithub":{"count":2,"skipped":0,"earliest":"2022-01-03","earliestUrl":"https://github.com/RobertoLeonFR-ES/Exploit-Win32.CVE-2012-0158.F.doc","repos":[{"name":"Sunqiz/CVE-2012-0158-reproduction","url":"https://github.com/Sunqiz/CVE-2012-0158-reproduction","stars":1,"created":"2022-08-15"},{"name":"RobertoLeonFR-ES/Exploit-Win32.CVE-2012-0158.F.doc","url":"https://github.com/RobertoLeonFR-ES/Exploit-Win32.CVE-2012-0158.F.doc","stars":0,"created":"2022-01-03"}]},"metasploit":[{"name":"MS12-027 MSCOMCTL ActiveX Buffer Overflow","module":"exploit/windows/fileformat/ms12_027_mscomctl_bof","type":"exploit","disclosureDate":"2012-04-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms12_027_mscomctl_bof.rb"}],"first":{"date":"2012-04-10","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms12_027_mscomctl_bof.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1203"],"provenance":"ai"},{"stage":"related","techniques":["T1189"],"provenance":"source"},{"stage":"related","techniques":["T1190","T1059","T1546","T1554","T1491","T1565"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2012-01-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://web.archive.org/web/20120907091804/http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf","provenance":"source"},{"date":"2012-04-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0158","provenance":"source"},{"date":"2012-04-10","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2012-04-25, PoC-in-GitHub 2022-01-03","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms12_027_mscomctl_bof.rb","provenance":"source"},{"date":"2016-01-24","kind":"report","label":"Named in unit42.paloaltonetworks.com: Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists","url":"https://unit42.paloaltonetworks.com/scarlet-mimic-years-long-espionage-targets-minority-activists/","provenance":"machine"},{"date":"2016-10-21","kind":"report","label":"Named in forcepoint.com: BITTER: A Targeted Attack Against Pakistan | Forcepoint BITTER: a targeted attack against Paki…","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan","provenance":"machine"},{"date":"2017-06-22","kind":"report","label":"Named in trendmicro.com: The Trail of BlackTech’s Cyber Espionage Campaigns","url":"https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html","provenance":"machine"},{"date":"2019-05-30","kind":"report","label":"Named in Lab52 / S2 Grupo: Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures)","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/lab52_2019-05-30_leviathan-geostrategy-and-ttp-technical.txt","provenance":"machine"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2012-0196","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":3494},"priority":{"score":89.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 5415 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9998"},{"name":"Named in threat reports","points":10.0,"detail":"15 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 2 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}