Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability

Who is affected

How to fix it

Treat CVE-2012-1854 as a legacy Microsoft Visual Basic for Applications insecure library loading risk. Microsoft MS12-046 says the issue can allow remote code execution when a user opens an Office-related file from an untrusted location next to a crafted DLL. Apply the MS12-046 updates for affected Office and VBA runtime deployments, and update third-party applications that ship their own vulnerable VBE6.dll copy. Unsupported Office, VBA SDK, or embedded VBA runtime deployments should be removed or replaced rather than left exposed.

1. Inventory Microsoft Office 2003, Office 2007, Office 2010, Microsoft VBA runtime, VBA SDK, and third-party applications that bundle VBE6.dll.
2. Apply the relevant MS12-046 Office and VBA security updates, including the applicable KB updates for the installed Office version and shared VBA runtime.
3. Scan for vulnerable VBE6.dll copies that may have been deployed by third-party applications outside the standard shared component location.
4. Contact vendors or update third-party applications that bundle their own VBA runtime and are not remediated by Microsoft Office updates.
5. Disable loading libraries from WebDAV and remote network shares where the Microsoft workaround is appropriate for the environment.
6. Block or warn on Office documents opened from untrusted network shares, WebDAV paths, compressed archives, and external mail sources.
7. Reduce user privileges on affected endpoints while patching and remove local admin rights where not required.
8. Retire unsupported Office or VBA SDK deployments that cannot be patched.

Verify the fix

• Confirm MS12-046 updates are installed for all affected Office and VBA runtime deployments.
• Confirm file inventory no longer finds vulnerable VBE6.dll copies in application directories or shared runtime locations.
• Confirm update management or vulnerability scanning no longer flags CVE-2012-1854.
• Test that business-critical VBA applications still run after the update or vendor replacement.
• Review endpoint telemetry for suspicious DLL loading from document directories, WebDAV paths, or remote shares.

Related categories

Trusted references

FAQ