CVE-2012-1854

Microsoft Visual Basic for Applications (VBA) fails to fully specify the search path used when loading dynamic-link libraries, so applications embedding VBA may load a library from an attacker-controlled directory rather than a trusted one (CWE-426). An attacker triggers the flaw by convincing a user to open a crafted document or file in a location the attacker controls, such as a network share or web-accessible folder, causing a malicious DLL placed alongside the file to be loaded. Successful exploitation yields remote code execution with the privileges of the logged-on user, potentially giving attackers a foothold for follow-on activity such as malware or ransomware deployment. Any environment running Microsoft products that embed VBA is potentially affected, and typical exposure is broad because VBA ships with Microsoft Office deployments. The flaw was added to the CISA Known Exploited Vulnerabilities catalog on 2026-04-13, indicating confirmed in-the-wild exploitation, with a 21% EPSS probability of exploitation in the next 30 days (97th percentile).

What to do: Apply Microsoft's mitigations per the CISA KEV required action and applicable BOD 22-01 guidance, prioritizing patching of Microsoft Office/VBA components in line with Microsoft's advisory for this vulnerability. As interim mitigation, prevent applications from loading libraries from untrusted, user-writable directories (e.g., avoid opening untrusted documents from network shares, web folders, or download locations) and ensure system-wide DLL search safety settings are enabled. Because there is no known public PoC and exploitation is confirmed in the wild, treat this as a high-priority remediation item and check patch-management and vulnerability-management records for coverage across Office/VBA-bearing endpoints.