The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in…
Priority CRITICAL 97Exploited in the wildCWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-94.
Summary
The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."
Why it matters now
Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03Known ransomware use
EPSS 0.99976 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:* | 2003 sp3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:* | 2007 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:* | 2007 sp3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2010:-:*:*:*:*:x86:* | 2010 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2010:sp1:*:*:*:*:x86:* | 2010 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_web_components:2003:sp3:*:*:*:*:*:* | 2003 sp3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server_2000:-:sp4:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server_2005:-:sp4:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server_2008:-:sp2:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server_2008:-:sp3:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:* Versions 2003 sp3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:* Versions 2007 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:* Versions 2007 sp3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2010:-:*:*:*:*:x86:* Versions 2010 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2010:sp1:*:*:*:*:x86:* Versions 2010 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_web_components:2003:sp3:*:*:*:*:*:* Versions 2003 sp3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server_2000:-:sp4:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server_2005:-:sp4:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server_2008:-:sp2:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server_2008:-:sp3:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:sql_server_2008:r2:-:*:*:*:*:*:* | r2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server_2008:r2:sp1:*:*:*:*:*:* | r2 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:biztalk_server:2002:sp1:*:*:*:*:*:* | 2002 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:commerce_server:2002:sp4:*:*:*:*:*:* | 2002 sp4 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:commerce_server:2007:sp2:*:*:*:*:*:* | 2007 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:commerce_server_2009:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:commerce_server_2009:r2:*:*:*:*:*:*:* | r2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_basic:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:* | 8.0 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:* | 9.0 sp2 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:sql_server_2008:r2:-:*:*:*:*:*:* Versions r2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server_2008:r2:sp1:*:*:*:*:*:* Versions r2 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:biztalk_server:2002:sp1:*:*:*:*:*:* Versions 2002 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:commerce_server:2002:sp4:*:*:*:*:*:* Versions 2002 sp4 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:commerce_server:2007:sp2:*:*:*:*:*:* Versions 2007 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:commerce_server_2009:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:commerce_server_2009:r2:*:*:*:*:*:*:* Versions r2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_basic:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:* Versions 8.0 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:* Versions 9.0 sp2 Vulnerable ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2021-11-03 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2012-0158
- 2026-10-03 Alias added: GHSA-xc3w-wqx5-qrf9
References
More Microsoft Biztalk Server vulnerabilities
- TI-2007-00914 Unspecified vulnerability in the Cryptographic API Component Object Model Certificates… CVSS 2.0HIGH 9.3
- TI-2009-02384 Heap-based buffer overflow in the Office Web Components ActiveX Control in Microsoft… CVSS 2.0HIGH 9.3
- TI-2007-01167 Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000… CVSS 2.0HIGH 9.3
- TI-2003-00113 SQL injection vulnerability in the Document Tracking and Administration (DTA) website of… CVSS 2.0HIGH 7.5
- TI-2003-00112 Buffer overflow in the HTTP receiver function (BizTalkHTTPReceive.dll ISAPI) of Microsoft… CVSS 2.0HIGH 7.5
- TI-2015-02176 Cross-site scripting (XSS) vulnerability in uddi/search/frames.aspx in the UDDI Services… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2012-0158 · CVE Program
- CVE-2012-0158 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-xc3w-wqx5-qrf9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences