← Vulnerability feed

Vulnerability record · CVE-2012-1891 · published 10 July 2012

CVE-2012-1891: Microsoft data access components memory buffer overflow vulnerability

Microsoft · Data Access Components

Heap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote attackers to execute arbitrary code via crafted XML data that triggers access to an uninitialized object in memory, aka "ADO Cachesize Heap Overflow RCE Vulnerability."

9.8 CVSS 3.1 Critical EPSS 29% · top 1.9% CWE-119 · Memory buffer overflowCWE-908 · Use of uninitialized resource
9.8CVSS 3.1 base score, v2 9.3
29%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
6References
16 Jun 2026Last modified by NVD

Description

Heap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote attackers to execute arbitrary code via crafted XML data that triggers access to an uninitialized object in memory, aka "ADO Cachesize Heap Overflow RCE Vulnerability."

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.us-cert.gov/cas/techalerts/TA12-192A.html US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-045
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14783
http://www.us-cert.gov/cas/techalerts/TA12-192A.html US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-045
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14783

Track CVE-2012-1891 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2003-0903Microsoft data access components memory buffer overflow vulnerabilityBuffer overflow in a component of Microsoft Data Access Components (MDAC) 2.5 through 2.8 allows remote attackers to execute arbitrary code via a mal…EPSS 37%10.0CVE-2002-1918Microsoft data access components vulnerabilityBuffer overflow in Microsoft Active Data Objects (ADO) in Microsoft MDAC 2.5 through 2.7 allows remote attackers to have unknown impact with unknown …EPSS 16%10.0CVE-1999-1011Microsoft MDAC RDS DataFactory unsafe methods allow remote command executionThe Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC), as shipped with IIS 3.x and 4.x, exposes unsafe metho…EPSS 77%analysed9.3CVE-2011-0026Microsoft data access components vulnerabilityInteger signedness error in the SQLConnectW function in an ODBC API (odbc32.dll) in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Wind…EPSS 34%9.3CVE-2011-0027Microsoft MDAC/WDAC ADO Record memory allocation flaw enables remote code executionMicrosoft Data Access Components (MDAC) 2.8 SP1/SP2 and Windows Data Access Components (WDAC) 6.0 fail to properly validate memory allocation for int…EPSS 54%analysed9.3CVE-2006-5559Microsoft data access components improper input validation vulnerabilityThe Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Microsoft Data …EPSS 44%7.5CVE-2003-0353Microsoft data access components vulnerabilityBuffer overflow in a component of SQL-DMO for Microsoft Data Access Components (MDAC) 2.5 through 2.7 allows remote attackers to execute arbitrary co…EPSS 22%7.5CVE-2002-1142Microsoft MDAC RDS Data Stub heap buffer overflow allows remote code executionA heap-based buffer overflow exists in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6 and Intern…EPSS 76%analysed

Source: NIST National Vulnerability Database (record CVE-2012-1891), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.