cbcvebase.
CVE-2012-0185
published 2012-05-09

CVE-2012-0185: Heap-based buffer overflow in Microsoft Excel 2007 SP2 and SP3 and 2010 Gold and SP1, Excel Viewer, and Office Compatibility Pack SP2 and SP3 allows remote…

PriorityP258critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
24.63%
97.7th percentile
Heap-based buffer overflow in Microsoft Excel 2007 SP2 and SP3 and 2010 Gold and SP1, Excel Viewer, and Office Compatibility Pack SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted spreadsheet that triggers incorrect handling of memory during opening, aka "Excel MergeCells Record Heap Overflow Vulnerability."

Affected

2 ranges
VendorProductVersion rangeFixed in
microsoftexcel——
microsoftexcel——

Detection & IOCsextracted from sources · hover to see the quote

bytes
|09 08 10 00 00 06 05 00|
bytes
|57006F0072006B0062006F006F006B00|
snort
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Microsoft Excel file download - SET 1"; flow:established,to_client; flowbits:isset,OLE.CompoundFile; flowbits:set,ETPRO.Microsoft.Excel; flowbits:noalert; file.data; content:"|09 08 10 00 00 06 05 00|"; distance:512; content:"|57006F0072006B0062006F006F006B00|"; fast_pattern; reference:cve,2012-0185; classtype:attempted-user; sid:2025086; rev:9; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2012_05_10, cve CVE_2012_0185, deployment Perimeter, confidence Medium, signature_severity Major, tag Web_Client_Attacks, updated_at 2024_03_14;)
  • →Detect delivery of malicious Excel files over HTTP by checking for the OLE Compound File flowbit being set, then matching the Excel BIFF8 BOF record bytes `|09 08 10 00 00 06 05 00|` at offset 512+ and the UTF-16LE 'Workbook' stream name `|57006F0072006B0062006F006F006B00|`.
  • →The vulnerability is triggered during file open of a crafted spreadsheet; monitor process creation and memory anomalies in Excel 2007/2010 and Excel Viewer upon opening untrusted .xls/.xlsx files. ↗
  • ·The Snort/Suricata rule (SID 2025086) uses `flowbits:noalert`, meaning it is a pre-classifier rule that sets the `ETPRO.Microsoft.Excel` flowbit for use by downstream rules rather than generating alerts on its own. Ensure dependent rules consuming this flowbit are also enabled.
  • ·Detection is scoped to HTTP traffic from external networks to internal hosts (`$EXTERNAL_NET any -> $HOME_NET any`); Excel files delivered via email attachments, SMB, or other vectors will not be caught by this rule.
  • ·The rule requires the upstream OLE Compound File flowbit (`OLE.CompoundFile`) to already be set; ensure the prerequisite OLE detection rule is active and firing correctly in the ruleset.
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.