CVE-2012-0158

Imagine a “plug-in” component inside older Microsoft Office-related software that’s supposed to safely display certain list and tree views. This flaw lets an attacker trick the computer into running attacker code when a user opens a specially prepared file or visits a crafted page. If this succeeds, the attacker can take over the machine and do things like steal information, install ransomware, or disrupt operations.

This matters if you run Microsoft Office (and especially older Office service packs) or systems that include the related Office Web Components and the specific runtimes listed as affected (including certain SQL Server, BizTalk Server, Commerce Server, Visual Basic, and Visual FoxPro setups). Even though exploitation needs a user to be tricked (open/visit), it has been considered known exploited by CISA, so it’s not a purely theoretical risk. Treat it as a real risk on any internet-reachable workflow (email links, document downloads, web content) where an attacker can get a user to open a crafted web page, Office document, or .rtf file using these components.

This is RED because CISA has confirmed it as actively known to be exploited (added to the KEV list), and the remediation deadline has already passed. Attackers are using this bug to run code after tricking users with crafted content, which makes it a direct, practical threat to business systems that include the affected MSCOMCTL.OCX controls.