CVE-2012-0158: Microsoft MSCOMCTL.OCX ActiveX controls remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware use, has an extremely high EPSS score, and allows unauthenticated remote code execution with only user interaction.

What it is

The ListView, ListView2, TreeView and TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls fail to handle crafted input, allowing memory corruption that leads to arbitrary code execution. The flaw affects a wide range of Microsoft products that ship or embed the control, including Office, SQL Server, BizTalk Server, Commerce Server, Visual FoxPro and the Visual Basic 6.0 Runtime. It matters because it was exploited in the wild and remains in CISA's KEV catalog.

Impact

An attacker who gets the crafted content processed gains arbitrary code execution in the context of the victim user. That can mean full compromise of the user's data and credentials on the affected host.

Attack surface

Reachable remotely over the network via a crafted web site, Office document or .rtf file that instantiates the vulnerable ActiveX control. No authentication is required, but the CVSS vector (UI:R) indicates user interaction is needed, such as opening the document or visiting the page.

Exploitation

Listed in CISA KEV since 2021-11-03 with known ransomware campaign use, and EPSS is near the top of the scale (0.99976, 99.979th percentile). The description states it was exploited in the wild in April 2012.

What to do

• Apply the Microsoft update in security bulletin MS12-027 (KB2686509) to all affected products, prioritizing Office, SQL Server and the VB6 runtime.
• Remove or block the vulnerable MSCOMCTL.OCX ActiveX controls where they are not required, using the kill-bit guidance in MS12-027.
• Enforce Protected View and disable ActiveX in Office documents, and block untrusted .rtf and Office attachments at the mail and web gateways.
• Retire or isolate end-of-life platforms that cannot be patched, such as Office 2003, SQL Server 2000 and Visual FoxPro 8.0.
• Restrict outbound and inbound network access for hosts that still run these products to limit delivery of exploit documents.

Detection

• Hunt for Office, wscript, or browser processes loading MSCOMCTL.OCX and then spawning child processes such as cmd.exe, powershell.exe or rundll32.exe.
• Monitor for Office documents and .rtf files containing embedded ActiveX or OLE objects referencing MSCOMCTL.OCX ListView, ListView2, TreeView or TreeView2.
• Alert on crashes or heap corruption in MSCOMCTL.OCX reported by endpoint telemetry, especially clustered around document opens.
• Review proxy and mail logs for delivery of .rtf or Office attachments from untrusted senders to users on unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.