CVE Watch—

CVE-2012-1856

Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability

CVSS

—

No CVSS

EPSS

72.0%

p99

KEV

YES

Mar 3, 2022

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

72.0%EPSS · 30 days72.2%

2026-09-172026-10-15

KEV catalog record

Product

Microsoft / Office

Vulnerability

Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability

Added to KEV

Mar 3, 2022

Remediate by

Mar 24, 2022

Known ransomware use

Summary description

The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2012-1856

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2023-217157.3 HIG

96.1%

KEV—79Microsoft Office Publisher Security Feature Bypass Vulnerability58d CVE-2021-422927.8 HIG

98.7%

KEV—80Microsoft Excel Security Feature Bypass58d CVE-2021-386467.8 HIG

94.7%

KEV—78Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability67d CVE-2021-270597.6 HIG

93.3%

KEV—78Microsoft Office Remote Code Execution Vulnerability58d CVE-2017-11882—

100.0%

KEV—80Microsoft Office Memory Corruption Vulnerability—CVE-2015-1641—

99.9%

KEV—80Microsoft Office Memory Corruption Vulnerability—