The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office…
Priority CRITICAL 97Exploited in the wildPublished · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Server 2005 SP4, SQL Server 2008 SP2, SP3, R2, R2 SP1, and R2 SP2, Commerce Server 2002 SP4, Commerce Server 2007 SP2, Commerce Server 2009 Gold and R2, Host Integration Server 2004 SP1, Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP2, and Visual Basic 6.0 Runtime allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption, aka "MSCOMCTL.OCX RCE Vulnerability."
Why it matters now
Exploitation Active In CISA KEV since 2022-03-03CISA due date 2022-03-24
EPSS 0.72032 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 21
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:commerce_server:2002:sp4:*:*:*:*:*:* | 2002 sp4 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:commerce_server:2007:sp2:*:*:*:*:*:* | 2007 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:commerce_server:2009:*:*:*:*:*:*:* | 2009 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:commerce_server:2009:r2:*:*:*:*:*:* | 2009 r2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:host_integration_server:2004:sp1:*:*:*:*:*:* | 2004 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:* | 2003 sp3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:* | 2007 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:* | 2007 sp3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2010:sp1:x86:*:*:*:*:* | 2010 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_web_components:2003:sp3:*:*:*:*:*:* | 2003 sp3 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:commerce_server:2002:sp4:*:*:*:*:*:* Versions 2002 sp4 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:commerce_server:2007:sp2:*:*:*:*:*:* Versions 2007 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:commerce_server:2009:*:*:*:*:*:*:* Versions 2009 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:commerce_server:2009:r2:*:*:*:*:*:* Versions 2009 r2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:host_integration_server:2004:sp1:*:*:*:*:*:* Versions 2004 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:* Versions 2003 sp3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:* Versions 2007 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:* Versions 2007 sp3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2010:sp1:x86:*:*:*:*:* Versions 2010 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_web_components:2003:sp3:*:*:*:*:*:* Versions 2003 sp3 Vulnerable ·Microsoft
Show 11 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:sql_server:2000:sp4:*:*:*:*:*:* | 2000 sp4 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2000:sp4:analysis_services:*:*:*:*:* | 2000 sp4 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2005:sp3:express_advanced_services:*:*:*:*:* | 2005 sp3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2005:sp4:*:*:*:*:*:* | 2005 sp4 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2008:r2_sp1:*:*:*:*:*:* | 2008 r2_sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2008:r2_sp2:*:*:*:*:*:* | 2008 r2_sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2008:sp2:*:*:*:*:*:* | 2008 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2008:sp3:*:*:*:*:*:* | 2008 sp3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_basic:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:* | 8.0 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:* | 9.0 sp2 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:sql_server:2000:sp4:*:*:*:*:*:* Versions 2000 sp4 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2000:sp4:analysis_services:*:*:*:*:* Versions 2000 sp4 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2005:sp3:express_advanced_services:*:*:*:*:* Versions 2005 sp3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2005:sp4:*:*:*:*:*:* Versions 2005 sp4 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2008:r2_sp1:*:*:*:*:*:* Versions 2008 r2_sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2008:r2_sp2:*:*:*:*:*:* Versions 2008 r2_sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2008:sp2:*:*:*:*:*:* Versions 2008 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2008:sp3:*:*:*:*:*:* Versions 2008 sp3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_basic:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:* Versions 8.0 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:* Versions 9.0 sp2 Vulnerable ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2022-03-03 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2012-1856
- 2026-10-03 Alias added: GHSA-q2jx-rgv9-xm3x
References
More Microsoft Commerce Server vulnerabilities
- TI-2012-00154 The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in… KEVCVSS 3.1HIGH 8.8
- TI-2007-01167 Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000… CVSS 2.0HIGH 9.3
- TI-2006-01216 The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2… CVSS 2.0HIGH 7.5
- TI-2002-00607 Buffer overflow in AuthFilter ISAPI filter on Microsoft Commerce Server 2000 and 2002… CVSS 2.0HIGH 7.5
- TI-2002-00606 The Office Web Components (OWC) package installer for Microsoft Commerce Server 2000… CVSS 2.0HIGH 7.5
- TI-2002-00046 Buffer overflow in AuthFilter ISAPI filter on Microsoft Commerce Server 2000 allows… CVSS 2.0HIGH 7.5
Sources
- CVE-2012-1856 · CVE Program
- CVE-2012-1856 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-q2jx-rgv9-xm3x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences