CVE-2012-1856

CVE-2012-1856 is a remote code execution flaw in the TabStrip ActiveX control in the Common Controls library (MSCOMCTL.OCX) that ships with Microsoft Office, classified as code injection (CWE-94). An attacker triggers it by getting a victim to open a specially crafted document or browse to a crafted web page that instantiates the control and corrupts the system state, allowing arbitrary code execution in the context of the user. Successful exploitation gives the attacker the privileges of the logged-on user, enabling malware delivery or lateral movement, which matches the weaponized-document patterns seen in APT campaigns referenced in related reporting. Any user of Microsoft Office where the vulnerable control is present and loadable from untrusted documents or web content is affected. Exploitation is confirmed in the wild: the flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03) and EPSS assigns a 72.2% probability of exploitation within 30 days (99th percentile), though no public proof-of-concept code is known.

What to do: Apply Microsoft's Office security updates per vendor instructions, as required by the CISA KEV catalog, and verify on legacy systems that MSCOMCTL.OCX has actually been updated rather than assumed. Restrict or prompt on ActiveX control instantiation from untrusted documents and web pages, and hunt for spearphishing documents or web content that exercises the TabStrip control, given the APT and malware-tooling activity noted in related reporting.