CVE-2012-1889: Microsoft XML Core Services memory corruption via crafted website

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with a very high EPSS score and allows remote code execution, though exploitation requires user interaction and the patch has existed since 2012.

What it is

Microsoft XML Core Services versions 3.0 through 6.0 access uninitialized memory, leading to memory corruption. A remote attacker can trigger this through a crafted website, potentially executing arbitrary code in the context of the user. The flaw is a high-severity, remotely reachable memory corruption issue in a widely deployed Windows component.

Impact

An attacker who successfully exploits this can execute arbitrary code with the privileges of the logged-on user, or cause a denial of service through memory corruption. Full compromise of confidentiality, integrity and availability is possible per the CVSS vector.

Attack surface

Reached over the network via a crafted website; the CVSS vector shows no privileges required but user interaction is required, meaning the victim must visit or be lured to the malicious page. No authentication is needed by the attacker.

Exploitation

This CVE is listed in CISA's Known Exploited Vulnerabilities catalog, indicating exploitation in the wild, and EPSS shows a very high 30-day probability (0.836, 99.7th percentile). No ransomware campaign use is documented.

What to do

• Apply the Microsoft security update referenced in MS12-043 (patch first).
• Disable or restrict the affected XML Core Services components where feasible.
• Enforce browser and email client settings that block untrusted ActiveX and script content.
• Segment and monitor legacy systems that still run unpatched XML Core Services.
• Track CISA KEV remediation deadlines for any remaining exposed hosts.

Detection

• Monitor for processes loading msxml3.dll, msxml4.dll, msxml5.dll or msxml6.dll spawning unexpected child processes.
• Hunt for browser or Office processes making anomalous outbound connections after visiting untrusted sites.
• Review endpoint telemetry for memory corruption crashes in XML Core Services modules.
• Alert on known exploit indicators tied to CVE-2012-1889 from threat intel feeds.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.