CVE-2012-1856VulnerabilityPublished 03/03/2022Updated 10/24/2026

CVE-2012-1856: Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability

Affects Microsoft OfficeSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/03/2022
KEV deadline: 03/24/2022
EPSS: 72.0% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2012-1856 (opens in a new tab)

Description

CVE-2012-1856 is a remote code execution vulnerability in the TabStrip ActiveX control within MSCOMCTL.OCX used by Microsoft Office. An attacker can exploit this flaw by crafting a malicious document or web page that triggers system-state corruption, allowing arbitrary code execution. This vulnerability has been exploited in the wild and is considered high severity.

Summary

The vulnerability exists in the TabStrip ActiveX control in the Common Controls component MSCOMCTL.OCX of Microsoft Office. Remote attackers can execute arbitrary code by delivering a specially crafted document or web page that causes system-state corruption. This flaw enables attackers to run code in the context of the user, potentially leading to full system compromise.

Impact

Successful exploitation allows remote attackers to execute arbitrary code on affected systems, potentially leading to full control of the victim machine. This can result in data theft, system manipulation, or further malware installation. The vulnerability has been observed in active exploitation campaigns.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official remediation details are provided, users should monitor Microsoft advisories for updates. Until a fix is available, avoid opening untrusted documents or visiting suspicious web pages that could trigger this vulnerability.

Weaknesses

CWE-94Code Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:25:37 UTC

Weaknesses

References

Related threats