{"id":"microsoft-vba-library-loading-attacks-apr-2026","category":"patch","status":"closed","title":"Microsoft VBA flaw CVE-2012-1854 listed as exploited; security updates available since 2012","tldr":"CISA flagged a VBA flaw affecting old Windows Office versions and other VBA-based programs. Microsoft released fixes in 2012. Check the relevant Office updates and ask other software vendors whether their bundled VBA copies are fixed.","summary":"CVE-2012-1854 affects Microsoft Visual Basic for Applications, a component used by older Windows Office releases and other desktop programs. It can load an unsafe software library and run an attacker’s code with the user’s permissions. Microsoft released fixes in July 2012, when it already knew of targeted attacks. The November 2012 Office 2003 reissue addressed a certificate issue, rather than an incomplete vulnerability fix. CISA added the flaw to its exploited catalogue on 13 April 2026; its 3 November catalogue still lists ransomware use as unknown. The reviewed sources do not identify the recent attackers or victims. Microsoft’s patches are available, but Office updates do not necessarily replace VBA copies bundled separately by other software makers; those require confirmation from the relevant vendor.","action":"Ask your IT provider or computer support person to check the MS12-046 updates listed below, especially both required Office 2010 packages. For other programs using VBA, ask their maker whether their bundled copy is fixed; updating Office alone may leave it exposed.","product":"Microsoft Office 2003, 2007 and 2010 for Windows; Microsoft Visual Basic for Applications","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2012-1854"],"tags":["microsoft","office","vba","windows","code-execution","actively-exploited"],"affected":["Microsoft Office 2003 Service Pack 3, including affected standalone Office programs","Microsoft Office 2007 Service Pack 2 and Service Pack 3, including affected standalone Office programs","Microsoft Office 2010 original release and Service Pack 1, 32-bit and 64-bit","Microsoft Visual Basic for Applications runtime 6.3, 6.4 and 6.5","Microsoft Visual Basic for Applications SDK 6.3, 6.4 and 6.5; third-party applications distributing the vulnerable runtime"],"fixed":["Office 2003 SP3: KB2598361, subsequently reissued as KB2687626","Office 2007 SP2 and SP3: KB2596744","Office 2010 and SP1, 32-bit and 64-bit: both KB2598243 and KB2553447","VBA runtime: KB2688865, installing Vbe6.dll 6.5.10.54","VBA SDK: updated SDK supplied through Summit Software; separately bundled runtime copies require an application-vendor update"],"matches":[{"platform":"windows","app":"Microsoft Office 2003","bundle":"","fixed":"KB2598361 or KB2687626"},{"platform":"windows","app":"Microsoft Office 2007","bundle":"","fixed":"KB2596744"},{"platform":"windows","app":"Microsoft Office 2010","bundle":"","fixed":"KB2598243 and KB2553447"},{"platform":"windows","app":"Microsoft Visual Basic for Applications","bundle":"","fixed":"6.5.10.54"}],"sources":[{"kind":"advisory","title":"Microsoft Security Bulletin MS12-046","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046","by":"Microsoft","date":"2012-11-13"},{"kind":"advisory","title":"MS12-046: Vulnerability in Visual Basic for Applications could allow remote code execution","url":"https://support.microsoft.com/kb/2707960","by":"Microsoft","date":"2012-07-10"},{"kind":"advisory","title":"MS12-046: Security update for Visual Basic for Applications","url":"https://support.microsoft.com/en-us/help/2688865","by":"Microsoft","date":"2012-07-10"},{"kind":"advisory","title":"Known Exploited Vulnerabilities catalogue, 3 November 2026 edition","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-11-03"},{"kind":"advisory","title":"CVE-2012-1854 record, including CISA's CVSS assessment","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2012/1xxx/CVE-2012-1854.json","by":"CVE Program","date":"2026-04-14"},{"kind":"news","title":"Zombie Microsoft bugs rise from the dead, pave way for crims and ransomware scum","url":"https://www.theregister.com/security/2026/04/13/ransomware-scum-other-crims-exploit-4-old-microsoft-bugs/5222887","by":"The Register","date":"2026-04-13"},{"kind":"news","title":"Active exploitation of old Microsoft bugs prompt CISA catalog inclusion","url":"https://www.scworld.com/brief/active-exploitation-of-old-microsoft-bugs-prompt-cisa-catalog-inclusion","by":"SC Media","date":"2026-04-14"}],"started":"2026-04-13","closed":"2026-04-13","created":"2026-11-03T22:21:36.646Z","updated":"2026-11-03T22:21:36.646Z","cve_notes":[{"cve":"CVE-2012-1854","name":"Unsafe library loading in Microsoft VBA","what":"VBA’s handling of library search locations can let an attacker-controlled library run code with the permissions of the person using the affected application.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-04-13","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2012-1854 to its catalogue of vulnerabilities used in attacks, with a 27 April remediation deadline for US federal civilian agencies. Ransomware use was marked unknown.","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2012-11-13","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Microsoft replaced Office 2003 update KB2598361 with KB2687626 because of a certificate timestamp issue. Customers who had successfully installed the original update needed no further action.","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046","by":"Microsoft","patch":null},{"at":"2012-07-10","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Microsoft published MS12-046 and security updates for affected Office and VBA software. It already knew of limited, targeted attacks attempting to exploit CVE-2012-1854.","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046","by":"Microsoft","patch":"patched"}],"url":"https://hard.fyi/live/microsoft-vba-library-loading-attacks-apr-2026/","json":"https://hard.fyi/api/live?id=microsoft-vba-library-loading-attacks-apr-2026"}