CVE-2012-5896: Quest InTrust AnnotateX ActiveX control uninitialized pointer RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 10.0 with public exploit code and very high EPSS, but no KEV listing and the affected product is an older, likely limited-deployment enterprise tool.

What it is

The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not properly implement the Add method, leaving an uninitialized pointer that can be controlled via a memory address in the first argument. A remote attacker can exploit this to execute arbitrary code in the context of the process hosting the control. The flaw is reachable over the network with no authentication and no user interaction beyond loading the malicious page or document that instantiates the control.

Impact

Successful exploitation gives the attacker arbitrary code execution with the privileges of the user or application hosting the ActiveX control, typically leading to full compromise of the affected Windows host. Because the control is browser-instantiable, a single crafted page can yield code execution without further privileges.

Attack surface

Reached remotely over the network (AV:N) with low complexity and no authentication (AC:L/Au:N) by instantiating the AnnotateX ActiveX control and invoking its Add method with a crafted first argument. The victim must load attacker-controlled content that references the control, so some form of user interaction (visiting a page or opening a document) is required in practice.

Exploitation

Public exploit code exists, including a Metasploit browser module and Exploit-DB entry, and EPSS is 0.69387 (99.3rd percentile), indicating high likelihood of exploitation. The CVE is not listed in CISA KEV, so there is no confirmed in-the-wild exploitation record in that dataset.

What to do

• Upgrade Quest InTrust to a version later than 10.4.0.853 or apply the vendor fix referenced in the Secunia advisory.
• Disable or remove the AnnotateX.dll ActiveX control and kill its CLSID in the registry, or set the kill-bit for the control in Internet Explorer.
• Restrict browser and document handling of ActiveX controls, and block untrusted sites from instantiating the control via IE security zones or Group Policy.
• Where the control is not required, uninstall or disable the Annotation Objects Extension component entirely.
• Monitor vendor advisories for a patched build and treat any remaining 10.4.0.853 or earlier installations as unsupported for this control.

Detection

• Hunt for processes loading AnnotateX.dll, especially browser or document-viewer processes, and alert on unexpected loads.
• Monitor for the Metasploit module intrust_annotatex_add or equivalent exploit traffic and for known exploit URLs in proxy or IDS logs.
• Search endpoint telemetry for crashes or memory-corruption events in processes hosting the AnnotateX control, which may indicate exploitation attempts.
• Audit hosts for the presence of the vulnerable AnnotateX.dll and its version to identify exposed systems.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.