VBA CVE-2012-1854: 2012 DLL Loading Bug Joins KEV

What to do

1. Inventory endpoints for Office 2003, 2007 and 2010 and plan their removal; Office 2010 left extended support in October 2020.
2. Search for stray copies of VBE6.dll installed by third-party applications and ask those vendors for builds with the updated runtime.
3. Where legacy Office must stay, confirm the MS12-046 KBs are installed.
4. Block outbound SMB (TCP 139/445) and WebDAV to the internet so documents cannot be opened from attacker-controlled shares.

How to check if you are affected or compromised

• Run a recursive search for VBE6.dll and record each file version and path; anything outside an Office or shared VBA folder needs a vendor check.
• In Sysmon or EDR image-load data, look for Office processes loading DLLs from network shares, WebDAV paths or the folder of the opened document.
• Review proxy and firewall logs for outbound SMB or WebDAV connections initiated by Office applications.

What happened#

On July 10, 2012, Microsoft published MS12-046 to fix CVE-2012-1854, an insecure library loading flaw in Visual Basic for Applications (VBA). The CVE record places the bug in VBE6.dll, the VBA runtime. When a user opened an Office file, such as a .docx, Office could load a DLL from the same folder. An attacker who placed a crafted DLL next to a legitimate document, typically on a network or WebDAV share, could run code as that user. Microsoft rated it Important and said at release it was "aware of limited, targeted attacks attempting to exploit the vulnerability." Bai Haowen of Huawei Security Labs reported it.

Almost 14 years later, on April 13, 2026, CISA added the CVE to its Known Exploited Vulnerabilities catalog, with an April 27 deadline for federal agencies. It came in a batch of six that also included a FortiClient EMS SQL injection (CVE-2026-21643) and an Exchange deserialization bug (CVE-2023-21529). CISA's enrichment scores it CVSS 3.1 7.8, local vector with user interaction, and marks it as not automatable.

Who is affected#

Per MS12-046: Office 2003 SP3, Office 2007 SP2 and SP3, Office 2010 and 2010 SP1, the standalone VBA runtime, and VBA SDK 6.3, 6.4 and 6.5. The bulletin warns that third-party applications can ship their own copy of VBE6.dll outside the shared location. Microsoft's update will not replace those copies, so the application vendor has to ship a fixed build. Office 2010, the newest version listed, left extended support in October 2020.

Do you really need to act?#

Most organizations do not. No public source explains the 2026 listing. The Hacker News pointed only to Microsoft's 2012 statement and wrote that "the exact nature of the attacks is presently unknown." Our searches found no later campaign report as of Oct 23, 2026. CISA did not say whether its evidence is new or the original 2012 activity.

The attack also has real preconditions. A user must open a document from a folder that also holds the attacker's DLL. Microsoft notes that SMB is often blocked at the perimeter firewall, which limits the remote path. The residual risk sits in two places. One is a forgotten machine still running Office 2003, 2007 or 2010. The other is a niche engineering or business application that bundles an old VBA runtime and has not been updated since 2012. If you have neither, you can relax.

What to do now#

1. Inventory endpoints for Office 2003, 2007 and 2010, and move them to a supported release.
2. Find stray runtime copies. In PowerShell: Get-ChildItem C:\ -Recurse -Filter VBE6.dll -ErrorAction SilentlyContinue | Select-Object FullName, @{n='Ver';e={$_.VersionInfo.FileVersion}}. Ask the vendor of any application that owns a copy whether it includes the 2012 fix.
3. Where legacy Office must stay for now, confirm KB2687626 or KB2598361 (Office 2003), KB2596744 (2007), or both KB2598243 and KB2553447 (2010) are installed. The standalone runtime update is KB2688865.
4. Block outbound SMB (TCP 139 and 445) and WebDAV to the internet, as the bulletin's workarounds suggest.

How to tell if you were hit#

DLL planting leaves little trace in Office itself. Use endpoint telemetry. With Sysmon or EDR image-load events, look for WINWORD.EXE, EXCEL.EXE or POWERPNT.EXE loading unsigned DLLs from network shares, WebDAV paths or a downloads folder. Check proxy and firewall logs for outbound SMB or WebDAV sessions started by Office applications. On file shares, a lone DLL sitting next to documents is worth a look.

Timeline#

• Jul 10, 2012 — Microsoft releases MS12-046 and reports limited, targeted attacks.
• Nov 13, 2012 — Microsoft re-releases the Office 2003 update as KB2687626.
• Apr 13, 2026 — CISA adds CVE-2012-1854 to KEV.
• Apr 27, 2026 — Federal remediation deadline.

Vulnerability records

• CVE-2012-1854 · KEV 2026-04-13 · Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft — Security Bulletin MS12-046: Vulnerability in Visual Basic for Applications Could Allow Remote Code Execution (2707960) learn.microsoft.com
2. CVE record — CVE-2012-1854 cve.org
3. CISA — Known Exploited Vulnerabilities: CVE-2012-1854 cisa.gov
4. Microsoft — Lifecycle: Microsoft Office 2010 learn.microsoft.com

Coverage and analysis

1. The Hacker News — CISA Adds 6 Known Exploited Flaws (April 2026) thehackernews.com