Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2012-1854 is a high-severity Untrusted Search Path (CWE-426) vulnerability in Microsoft Office. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked in the top 2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability is an untrusted search path issue, also described as insecure library loading, in VBE6.dll. It affects Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1, as well as Microsoft Visual Basic for Applications (VBA) and the Summit Microsoft Visual Basic for Applications SDK. The flaw allows a Trojan horse DLL placed in the current working directory to be loaded instead of the legitimate library.
A local attacker can exploit the weakness by positioning a malicious DLL alongside a document such as a .docx file. When a vulnerable Office application or VBA component opens the file, the DLL is loaded with the privileges of the running process, resulting in arbitrary code execution and privilege escalation. The attack requires user interaction to open the document but needs no additional remote access.
Microsoft security bulletin MS12-046 and US-CERT alert TA12-192A recommend installing the vendor-supplied patches that correct the library search order. The updates are also referenced in OVAL definitions for automated detection.
The vulnerability was exploited in the wild in July 2012.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2012-1864
Vulnerability Data
Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges…
more
via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Visual Basic for Applications Insecure Library Loading Vulnerability," as exploited in the wild in July 2012.
- CWE(s)
- KEV Date Added
- 13 April 2026
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened configuration baselines can enforce safe search paths and restrict environment variables that enable the weakness.
Preventing execution of unauthorized code directly blocks the malicious binaries that an untrusted search path would load.
Secure development practices include avoiding or sanitizing externally influenced search paths in application code.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.