CVE-2012-2539: Microsoft Word RTF listoverridecount memory corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityConfirmed exploitation via CISA KEV and very high EPSS, but exploitation requires a user to open a crafted RTF file, limiting it below critical.

What it is

Microsoft Word, Word Viewer, Office Compatibility Pack and Office Web Apps mishandle crafted RTF data, causing an out-of-bounds write (CWE-787) that corrupts memory. Successful exploitation allows arbitrary code execution in the context of the opening user, and the flaw is listed in CISA KEV, so it is a confirmed real-world target.

Impact

An attacker gains arbitrary code execution with the privileges of the user who opens the document, or can crash the application to cause a denial of service.

Attack surface

Reached by a user opening a crafted RTF document or previewing it in an affected Office product; the CVSS vector shows local access with user interaction and no privileges required, so the victim must open or preview the malicious file.

Exploitation

CVE-2012-2539 is in CISA KEV (added 2022-03-28) and has a high EPSS 30-day probability of 0.53159 (99th percentile), indicating observed exploitation and elevated risk.

What to do

• Apply Microsoft security bulletin MS12-079 updates to all affected Word, Word Viewer, Office Compatibility Pack and Office Web Apps installations.
• Retire or isolate unsupported end-of-life versions (Word 2003 SP3, 2007 SP2/SP3, 2010 SP1) that cannot be patched.
• Block or strip inbound RTF attachments at mail and web gateways where business needs allow.
• Disable RTF preview in Outlook and Windows Explorer to remove the preview-based attack path.
• Run Office with least privilege and consider Protected View for documents from untrusted sources.

Detection

• Hunt for Office processes (WINWORD.EXE, wordview.exe) spawning child processes such as cmd.exe, powershell.exe or wscript.exe.
• Monitor for Word or Word Viewer crashes and memory-corruption events tied to RTF file opens.
• Alert on RTF files arriving as email attachments or downloads from external sources, especially with embedded objects.
• Review endpoint telemetry for document files written to temp or startup locations shortly after an Office document is opened.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.