Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
Description
Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Running Microsoft devices? Get an email when a new vulnerability comes out. Free, unsubscribe in one click.
Turn on Microsoft alerts
Turn on Microsoft alerts
Details
- Vendor
- Microsoft
- Product
- Microsoft Visual Basic for Applications
- CVE
- CVE-2012-1854
- Affected versions
- Office 2003: Office 2003 SP3
Office 2007: Office 2007 SP2 and SP3
Office 2010: Office 2010 Gold and SP1
Visual Basic for Applications: all versions
Visual Basic for Applications SDK: all versions (from the advisory and NVD; check the exact builds in the official advisory) - CVSS score
- 7.8
- Actively exploited
- Yes, listed in the CISA Known Exploited Vulnerabilities catalog
- CISA due date
- April 27, 2026 (deadline for US federal agencies: a good benchmark for you too)
- Source
- CISA KEV – original advisory
- Published
- April 13, 2026
The description and the recommended action are quoted from the public advisory; severity, exploitation status and affected versions are compiled automatically from public sources and may contain errors. The vendor's original advisory prevails: check it before taking action. This information is provided without warranty and does not replace a professional assessment.