CVE-2014-1761, Oh did you mean CVE-2012

CVE-2012-0158 is a remote code execution flaw in Microsoft's MSCOMCTL.OCX, the Windows Common Controls ActiveX component, where improper handling of crafted input allows memory corruption and code execution. It is typically triggered when an application that uses the control (most commonly Microsoft Office) processes specially crafted content, such as a malicious document or file, meaning a victim usually has to open attacker-supplied content. Successful exploitation lets an attacker run arbitrary code and take complete control of the affected system with the privileges of the current user. Any Windows system carrying a vulnerable copy of MSCOMCTL.OCX — including systems where the control was redistributed by legacy applications — is affected, which makes the potential population very large. Exploitation is confirmed and ongoing: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and EPSS assigns it the maximum reported probability of exploitation within 30 days.

Do: Apply the Microsoft security update for MSCOMCTL.OCX (per vendor instructions, per CISA's required action) on all systems, prioritizing endpoints and servers that open Office documents. Because exploitation commonly arrives via malicious documents, treat unsolicited Office/RTF attachments with suspicion and verify that applications that redistribute MSCOMCTL.OCX have installed a patched copy. Scan the estate for the presence and version of MSCOMCTL.OCX, especially on legacy Windows/Office installations that may be missed by routine patching.

CVE-2012-2539 is a remote code execution flaw in Microsoft Word that mishandles crafted RTF (Rich Text Format) data, allowing an attacker to execute arbitrary code as the logged-in user or crash Word in a denial of service. The flaw is triggered when Word processes a malicious RTF document, typically delivered as an email attachment or downloaded file; because Word also renders RTF content, simply opening or previewing attacker-supplied content can be enough to trigger it. Any user of an affected, unpatched Word installation who opens untrusted RTF documents is exposed; Microsoft shipped the fix in its December 2012 Word security bulletin (MS12-079). The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-28), confirming exploitation in the wild, and EPSS assigns a 53.2% probability of exploitation within 30 days (99th percentile), though no public PoC is known and ransomware use is unknown.

Do: Apply the Microsoft Word security update from the December 2012 bulletin (MS12-079) on any Office install still in service, per CISA's required action to apply vendor updates. Until patched, do not open RTF documents from untrusted sources and confirm whether legacy 2012-era Word builds remain in use in your environment.

CVE-2014-1761 is a memory corruption vulnerability (CWE-119) in Microsoft Word that can be triggered by processing a maliciously crafted document, such as one delivered as an email attachment. Successful exploitation corrupts memory in a way that allows an attacker to execute arbitrary code on the victim's system with the privileges of the current user. Anyone running an affected Microsoft Word installation is exposed, which in practice spans a very large share of business and consumer desktops given Word's ubiquity. The flaw is confirmed as exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-02-15, and EPSS assigns it a 77.5% probability of exploitation in the next 30 days (100th percentile). No public proof-of-concept is known, but the KEV listing and high EPSS indicate real-world attacker activity, and Word document flaws of this kind have historically featured in targeted APT and spear-phishing campaigns.

Do: Apply Microsoft's security update for CVE-2014-1761 to every Word installation per vendor instructions, treating it as an actively exploited, high-priority patch. Until patched, be alert for unsolicited Word documents arriving by email, and consider file-blocking policies for documents from untrusted sources. Check that legacy Word editions within your estate are covered, since older builds that no longer receive routine updates are the most likely to remain exposed.