CVE-2012-1854

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CVSS 7.8 high · n/a n/a · published 2012-07-10

Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Visual Basic for Applications Insecure Library Loading Vulnerability," as exploited in the wild in July 2012.

NVD · CVE.org

Coverage 1 source

1. 2026-04-13 CISA Cybersecurity Advisories critical CISA Adds Seven Known Exploited Vulnerabilities to Catalog

   CISA adds 7 vulnerabilities to its Known Exploited Vulnerabilities Catalog due to active exploitation.

Mentioned with

CVE-2020-9715 CVE-2023-21529 CVE-2023-36424 CVE-2025-60710

Also covered

• CVE-2026-88771 A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands CVSS 9.5 · 4 articles · 2026-09-29
• CVE-2026-91191 Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature CVSS 7.7 · 1 article · 2026-09-29
• CVE-2026-86950 Apple iOS and iPadOS CVSS 8.8 · 2 articles · 2026-09-29
• CVE-2026-84409 Lantronix G520 Series Cellular Gateway Cross-site Scripting CVSS 7.7 · 1 article · 2026-09-29
• CVE-2026-72510 Toptech TMS7 and TopHAT SQL Injection CVSS 8.5 · 1 article · 2026-09-29