Microsoft VBA flaw CVE-2012-1854 listed as exploited; security updates available since 2012
CISA flagged a VBA flaw affecting old Windows Office versions and other VBA-based programs. Microsoft released fixes in 2012. Check the relevant Office updates and ask other software vendors whether their bundled VBA copies are fixed.
Ask your IT provider or computer support person to check the MS12-046 updates listed below, especially both required Office 2010 packages. For other programs using VBA, ask their maker whether their bundled copy is fixed; updating Office alone may leave it exposed.
- Microsoft Office 2003fixed in KB2598361 or KB2687626 and later
- Microsoft Office 2007fixed in KB2596744 and later
- Microsoft Office 2010fixed in KB2598243 and KB2553447 and later
- Microsoft Visual Basic for Applicationsfixed in 6.5.10.54 and later
What’s happening
CVE-2012-1854 affects Microsoft Visual Basic for Applications, a component used by older Windows Office releases and other desktop programs. It can load an unsafe software library and run an attacker’s code with the user’s permissions. Microsoft released fixes in July 2012, when it already knew of targeted attacks. The November 2012 Office 2003 reissue addressed a certificate issue, rather than an incomplete vulnerability fix. CISA added the flaw to its exploited catalogue on 13 April 2026; its 3 November catalogue still lists ransomware use as unknown. The reviewed sources do not identify the recent attackers or victims. Microsoft’s patches are available, but Office updates do not necessarily replace VBA copies bundled separately by other software makers; those require confirmation from the relevant vendor.
- What
- Flaw
- Affects
- Microsoft Office 2003, 2007 and 2010 for Windows; Microsoft Visual Basic for Applications
- Affected
- Microsoft Office 2003 Service Pack 3, including affected standalone Office programs
Microsoft Office 2007 Service Pack 2 and Service Pack 3, including affected standalone Office programs
Microsoft Office 2010 original release and Service Pack 1, 32-bit and 64-bit
Microsoft Visual Basic for Applications runtime 6.3, 6.4 and 6.5
Microsoft Visual Basic for Applications SDK 6.3, 6.4 and 6.5; third-party applications distributing the vulnerable runtime - Fixed in
- Office 2003 SP3: KB2598361, subsequently reissued as KB2687626
Office 2007 SP2 and SP3: KB2596744
Office 2010 and SP1, 32-bit and 64-bit: both KB2598243 and KB2553447
VBA runtime: KB2688865, installing Vbe6.dll 6.5.10.54
VBA SDK: updated SDK supplied through Summit Software; separately bundled runtime copies require an application-vendor update - Since
- 13 Apr 2026
- Closed
- 13 Apr 2026
Timeline
- CISA added
CISA added CVE-2012-1854 to its catalogue of vulnerabilities used in attacks, with a 27 April remediation deadline for US federal civilian agencies. Ransomware use was marked unknown.
- Vendor revised
Microsoft replaced Office 2003 update KB2598361 with KB2687626 because of a certificate timestamp issue. Customers who had successfully installed the original update needed no further action.
- New fixFixed
Microsoft published MS12-046 and security updates for affected Office and VBA software. It already knew of limited, targeted attacks attempting to exploit CVE-2012-1854.
Sources
- Microsoft Security Bulletin MS12-046Microsoft · 13 Nov 2012
- MS12-046: Vulnerability in Visual Basic for Applications could allow remote code executionMicrosoft · 10 July 2012
- MS12-046: Security update for Visual Basic for ApplicationsMicrosoft · 10 July 2012
- Known Exploited Vulnerabilities catalogue, 3 November 2026 editionCISA · 3 Nov 2026
- CVE-2012-1854 record, including CISA's CVSS assessmentCVE Program · 14 Apr 2026
- Zombie Microsoft bugs rise from the dead, pave way for crims and ransomware scumThe Register · 13 Apr 2026
- Active exploitation of old Microsoft bugs prompt CISA catalog inclusionSC Media · 14 Apr 2026