CVE-2012-2539 Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a de...
HighCVSS 9.3
EPSS 53.0%
CISA KEV
added 2022-03-28 · due 2022-04-18
Exploited in the wild
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka "Word RTF 'listoverridecount' Remote Code Execution Vulnerability."
CISA Known Exploited Vulnerability
- Date added
- 2022-03-28
- Due date (FCEB)
- 2022-04-18
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft office compatibility pack | All versions | No fix listed |
| Microsoft office web apps | = 2010-sp1 | No fix listed |
| Microsoft office word viewer | All versions | No fix listed |
| Microsoft sharepoint server | = 2010 | No fix listed |
| Microsoft word | = 2003-sp3 | No fix listed |
| Microsoft word | = 2007-sp2 | No fix listed |
| Microsoft word | = 2007-sp3 | No fix listed |
| Microsoft word | = 2010-sp1 | No fix listed |
References
- TA12-346A third-party-advisory us-government-resource
- MS12-079 patch vendor-advisory
- oval:org.mitre.oval:def:16073 broken-link signature vdb-entry
- www.cisa.gov government-resource us-government-resource