Is CVE-2012-1856 actively exploited?

Yes. CVE-2012-1856 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2012-1856 be exploited remotely?

The attack vector of CVE-2012-1856 has not been classified yet.

What is the CVSS score of CVE-2012-1856?

CVE-2012-1856 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2012-1856

HIGHCISA KEVIN THE WILD

CVE-2012-1856

Published: March 3, 2022

EPSS:91.95%probability of exploitation in 30 daysPercentile:99.7th

Official Description

The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption.

NVD Source

CISA KEV Advisory

Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability

Added to KEV: 2022-03-03Federal patch deadline: 2022-03-24

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

A flaw in the TabStrip ActiveX control in Microsoft Office's MSCOMCTL.OCX allows remote attackers to execute arbitrary code. The high EPSS score of 0.91946 indicates a very high likelihood of exploitation, making this a critical concern. It is confirmed as exploited by CISA.

Active exploitation of this vulnerability has been observed in the wild. Attackers can leverage this remotely via crafted documents or web pages.

Recommended Action

Ensure all Microsoft Office installations are fully updated. Consider disabling or restricting ActiveX controls if not essential for business operations.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2012-1856 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2012-1856 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.