{"id":"CVE-2012-2539","kind":"vulnerability","aliases":["CVE-2012-2539"],"related":[],"title":"Microsoft Word: Microsoft Word Remote Code Execution Vulnerability","description":"Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka \"Word RTF 'listoverridecount' Remote Code Execution Vulnerability.\"","summary":"Microsoft Word can be made to run attacker code or crash when it opens a specially crafted RTF file. An attacker who gets a victim to open the document can run code as that user.","severity":"critical","cvss":9.3,"epss":0.53033,"exploited":true,"exploited_at":"2022-03-28T00:00:00+00:00","products":[{"name":"Microsoft Word","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","microsoft-word","office","other","windows"],"not_affected_if":["no-word-installed","patched-office"],"how_to_check":null,"fix":"Apply the Microsoft security update for this CVE per vendor instructions, as CISA requires; the specific patch and affected Word versions are not in the sources.","status":"open","published_at":"2012-12-12T00:55:01+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:20:00+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T21:20:00Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for this CVE per vendor instructions, as CISA requires; the specific patch and affected Word versions are not in the sources.","reach":"unknown","impact":"high","summary":"Microsoft Word can be made to run attacker code or crash when it opens a specially crafted RTF file. An attacker who gets a victim to open the document can run code as that user.","category":"other","who_cares":["microsoft-word","windows","office"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code as the user who opens a crafted RTF document.","analyst_note":"Confirm affected Word versions and the Microsoft bulletin number at the CISA KEV entry or the Microsoft Security Response Center advisory for CVE-2012-2539.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-office","no-word-installed"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000456,"input_tokens":2817,"output_tokens":348,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2012':10A,13A '-2539':11A,14A '2003':61C '2007':63C '2010':68C,82C 'aka':103C 'allow':84C 'app':81C 'arbitrari':89C 'attack':31B,44B,86C 'caus':92C 'code':6A,32B,55B,90C,108C 'compat':73C 'corrupt':98C 'craft':40B,100C 'crash':34B 'cve':9A,12A 'data':102C 'denial':94C 'document':52B 'execut':7A,88C,109C 'exploit':17B 'file':42B 'get':46B 'listoverridecount':106C 'made':28B 'memori':97C 'microsoft':1A,3A,15A,19B,24B,59C 'microsoft-word':18B 'offic':21B,72C,79C 'open':37B,50B 'pack':74C 'remot':5A,85C,107C 'rtf':41B,101C,105C 'run':30B,54B 'servic':96C 'sp1':69C,83C 'sp2':64C,75C 'sp3':62C,66C,77C 'special':39B 'user':58B 'via':99C 'victim':48B 'viewer':71C 'vulner':8A,110C 'web':80C 'window':23B 'word':2A,4A,16A,20B,25B,60C,70C,104C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2012-12-12T00:55:01+00:00","kev":{"dateAdded":"2022-03-28","dueDate":"2022-04-18","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2012-2539","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2012-2539","severity":null,"published_at":"2022-03-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:31+00:00","note":null},{"source":"epss","external_id":"CVE-2012-2539","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-2539","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2012-2539","url":"https://nvd.nist.gov/vuln/detail/CVE-2012-2539","severity":null,"published_at":"2012-12-12T00:55:01+00:00","modified_at":"2026-06-16T23:41:39+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}