CVE-2012-1854: Microsoft Office VBE6.dll Untrusted Search Path Privilege Escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is in CISA KEV with confirmed in-the-wild exploitation and a high EPSS score, though it requires local access and user interaction.

What it is

VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2/SP3, 2010 Gold/SP1, Microsoft VBA, and the Summit Microsoft VBA SDK loads a library from an untrusted search path. A local attacker who places a malicious DLL in the current working directory can get it loaded by the affected component. The flaw was exploited in the wild in July 2012.

Impact

An attacker gains code execution at the privilege level of the user who opens the crafted file, which can lead to full system compromise if that user has administrative rights.

Attack surface

Reached locally: the victim must open a file such as a .docx from a directory containing the attacker's Trojan horse DLL. No prior authentication is required, but user interaction (opening the file) is needed per the CVSS vector AV:L/UI:R.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog with a due date of 2026-04-27, and the NVD description states it was exploited in the wild in July 2012. EPSS gives a 30-day probability of 0.21028 (97.4th percentile).

What to do

• Apply the Microsoft MS12-046 update for affected Office, VBA, and VBA SDK versions.
• If patching is not possible, discontinue use of the affected product per CISA BOD 22-01 guidance.
• Do not open Office documents from untrusted directories or locations where unknown DLLs may reside.
• Restrict write access to directories used to open Office documents to prevent DLL planting.
• Follow vendor mitigation guidance in MS12-046 for any interim workarounds.

Detection

• Monitor for unexpected DLL files created in directories alongside Office documents, especially VBE6.dll or similarly named libraries.
• Alert on Office processes loading DLLs from user-writable or document directories rather than System32.
• Review endpoint logs for Office applications spawning child processes after opening documents from untrusted paths.
• Hunt for known exploitation artifacts tied to the July 2012 in-the-wild activity referenced in the NVD description.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.