{"id":"CVE-2012-1889","kind":"vulnerability","aliases":["CVE-2012-1889"],"related":[],"title":"Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote…","description":"Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.","summary":"Microsoft XML Core Services (MSXML) has a memory corruption bug that an attacker can trigger to run code on the affected Windows machine. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":9.3,"epss":0.83516,"exploited":true,"exploited_at":"2022-06-08T00:00:00+00:00","products":[{"name":"Microsoft XML Core Services","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft xml core services","fixed":[],"affected":"= 3.0","ecosystem":"vendor"},{"name":"microsoft xml core services","fixed":[],"affected":"= 4.0","ecosystem":"vendor"},{"name":"microsoft xml core services","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"microsoft xml core services","fixed":[],"affected":"= 5.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","internet-explorer","msxml","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the Microsoft updates for MSXML per vendor instructions, as CISA requires; the specific patch KB and fixed version are not in the sources.","status":"open","published_at":"2012-06-13T04:46:46+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:39+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:12:39Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft updates for MSXML per vendor instructions, as CISA requires; the specific patch KB and fixed version are not in the sources.","reach":"unknown","impact":"high","summary":"Microsoft XML Core Services (MSXML) has a memory corruption bug that an attacker can trigger to run code on the affected Windows machine. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["windows","msxml","internet-explorer"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs remote code on a vulnerable Windows machine.","analyst_note":"Find the Microsoft security bulletin (MS12-043 per public records) for affected Windows versions, the KB numbers, and the exploit vector (malicious web page or document) at https://msrc.microsoft.com.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000468,"input_tokens":2821,"output_tokens":372,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1889':19A,22A '-2012':18A,21A '3.0':5A,86C '4.0':6A,87C '5.0':7A,88C '6.0':9A,90C 'access':10A,91C 'activ':77B 'affect':70B 'allow':15A,96C 'arbitrari':101C 'attack':62B,98C 'bug':59B 'caus':104C 'cisa':73B 'code':67B,102C 'core':3A,25A,29A,33A,37A,41A,52B,84C 'corrupt':58B,110C 'craft':113C 'cve':17A,20A 'denial':106C 'execut':100C 'exploit':43B,78B 'explor':47B 'infrastructur':44B 'internet':46B 'internet-explor':45B 'list':74B 'locat':13A,94C 'machin':72B 'memori':12A,57B,93C,109C 'microsoft':1A,23A,27A,31A,35A,39A,50B,82C 'msxml':48B,54B 'remot':16A,97C 'run':66B 'servic':4A,53B,85C,108C 'services':26A,30A,34A,38A,42A 'site':115C 'trigger':64B 'uniniti':11A,92C 'via':111C 'web':114C 'wild':81B 'window':49B,71B 'xml':2A,24A,28A,32A,36A,40A,51B,83C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2012-06-13T04:46:46+00:00","kev":{"dateAdded":"2022-06-08","dueDate":"2022-06-22","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2012-1889","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2012-1889","severity":null,"published_at":"2022-06-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:31+00:00","note":null},{"source":"epss","external_id":"CVE-2012-1889","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-1889","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2012-1889","url":"https://nvd.nist.gov/vuln/detail/CVE-2012-1889","severity":null,"published_at":"2012-06-13T04:46:46+00:00","modified_at":"2026-06-16T23:40:29+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}