CVE-2012-1854
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedUntrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Visual Basic for Applications Insecure Library Loading Vulnerability," as exploited in the wild in July 2012.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceVBE6.dll insecurely loads dynamic link libraries from the current working directory without validating the library path, allowing a local attacker to place a malicious DLL that gets loaded with the privileges of the vulnerable application when a user opens a document from a directory the attacker controls.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data= 2003= 2007= 2010all versionsall versionsCVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Local
- Complexity
- Low
- Privileges
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Locate VBE6.dll on the systemSearch for VBE6.dll in common locations: %SystemRoot%\System32, %ProgramFiles%\Microsoft Office, %ProgramFiles(x86)%\Microsoft Office, and Office program directories (e.g., C:\Program Files\Microsoft Office\Office14). Use command: dir /s C:\VBE6.dll 2>nul or Get-ChildItem -Path C:\ -Filter VBE6.dll -Recurse -ErrorAction SilentlyContinueAffected if VBE6.dll is found on the system without corresponding security updates applied
-
Check the installed Microsoft Office versionOpen any Office application (Word, Excel, etc.), go to File > Help or File > Account, and note the version shown (e.g., 11.0 for Office 2003, 12.0 for Office 2007, 14.0 for Office 2010). Alternatively, check registry: HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration or HKLM\SOFTWARE\Microsoft\Office\version\Common\InstallRootAffected if Office version is 2003 (11.0), 2007 (12.0), or 2010 (14.0) and VBE6.dll is present without security updates
-
Check installed VBE6.dll file versionRight-click VBE6.dll > Properties > Details tab to view File Version. Common paths: C:\Windows\System32\VBE6.dll or C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.dll. Use: powershell (Get-Item 'C:\Windows\System32\VBE6.dll').VersionInfoAffected if VBE6.dll version matches unpatched versions prior to Microsoft security updates for this CVE (versions prior to the June 2012 security update release)
-
Verify if security update KB2597xxx is installedOpen Control Panel > Programs and Features > View installed updates, or run: wmic qfe list | findstr /i "2597" or Get-WmiObject -Class Win32_QuickFixEngineering | Where-Object {$_.HotFixID -like '*2597*'}Affected if No security update containing KB2597 (or similar June 2012 Office security update) is listed as installed
A user is affected if VBE6.dll is present on the system with an unpatched version from Office 2003/2007/2010 or VBA installations, and no corresponding security update from June 2012 is installed.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedApply Microsoft security updates for this vulnerability and avoid opening untrusted documents from directories you control; ensure documents are opened from trusted locations with controlled file access.
Microsoft Office 2013 or later (which includes the fixed VBA component); alternatively, move to Microsoft 365 which receives continuous security updates
- Apply Microsoft Security Bulletin MS12-060, which addresses the VBE6.dll insecure library loading vulnerability
- For Microsoft Office 2003: Install security update KB2683277
- For Microsoft Office 2007 SP2/SP3: Install security update KB2683277
- For Microsoft Office 2010 Gold/SP1: Install security update KB2683277
- For Visual Basic for Applications: Install the VBE6.dll update from MS12-060
- For Visual Basic for Applications SDK: Update to a version that includes the patched VBE6.dll
- After applying the update, verify VBE6.dll version reflects the patched build (6.5.10.51 or higher)
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation2.0 h
- Testing1.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,744.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2012-1854 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2012-1854 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data