CVE-2012-1887 : Use-after-free vulnerability in Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and

Use-after-free vulnerability in Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1, and Office 2008 and 2011 for Mac, allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel SST Invalid Length Use After Free Vulnerability."

Published 2012-11-14 00:55:01

Updated 2025-04-11 00:51:22

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Memory CorruptionExecute code

Products affected by CVE-2012-1887

Microsoft » Office » Version: 2008 MAC Edition
cpe:2.3:a:microsoft:office:2008:*:mac:*:*:*:*:*
Matching versions
Microsoft » Office » Version: 2011 MAC Edition
cpe:2.3:a:microsoft:office:2011:*:mac:*:*:*:*:*
Matching versions
Microsoft » Excel » Version: 2003 Update SP3
cpe:2.3:a:microsoft:excel:2003:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Excel » Version: 2007 Update SP2
cpe:2.3:a:microsoft:excel:2007:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Excel » Version: 2007 Update SP3
cpe:2.3:a:microsoft:excel:2007:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Excel » Version: 2010 Update SP1 X64 Edition
cpe:2.3:a:microsoft:excel:2010:sp1:x64:*:*:*:*:*
Matching versions
Microsoft » Excel » Version: 2010 Update SP1 X86 Edition
cpe:2.3:a:microsoft:excel:2010:sp1:x86:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2012-1887

EPSS FAQ

61.62%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 98 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2012-1887

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2012-1887

CWE-399

Assigned by: nvd@nist.gov (Primary)

References for CVE-2012-1887

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-076

Microsoft Security Bulletin MS12-076 - Important | Microsoft Docs

CVEs referencing this url
http://www.securitytracker.com/id?1027752

Microsoft Excel Buffer Overflow, Memory Corruption, and Use-After-Free Errors Let Remote Users Execute Arbitrary Code - SecurityTracker

CVEs referencing this url
http://www.securityfocus.com/bid/56430

Microsoft Excel SST Invalid Length Use After Free Remote Code Execution Vulnerability
http://www.us-cert.gov/cas/techalerts/TA12-318A.html

Microsoft Updates for Multiple Vulnerabilities | CISA
US Government Resource

CVEs referencing this url
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15717

Repository / Oval Repository
https://exchange.xforce.ibmcloud.com/vulnerabilities/78074

Microsoft Excel SST Invalid Length code execution CVE-2012-1887 Vulnerability Report
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15970

Repository / Oval Repository

Jump to

Vulnerability Details : CVE-2012-1887

Products affected by CVE-2012-1887

Exploit prediction scoring system (EPSS) score for CVE-2012-1887

CVSS scores for CVE-2012-1887

CWE ids for CVE-2012-1887

References for CVE-2012-1887