CVE-2012-2528

published 2012-10-09

CVE-2012-2528: Use-after-free vulnerability in Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; Word Automation…

Priority P3 57 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

Use-after-free vulnerability in Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; Word Automation Services on Microsoft SharePoint Server 2010; and Office Web Apps 2010 SP1 allows remote attackers to execute arbitrary code via a crafted RTF document, aka "RTF File listid Use-After-Free Vulnerability."

Affected

4 ranges

Vendor	Product	Version range	Fixed in
microsoft	office_web_apps	—	—
microsoft	word	—	—
microsoft	word	—	—
microsoft	word	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → Trigger vector is a crafted RTF document exploiting a use-after-free in the RTF 'listid' handling within Microsoft Word/Office; detections should focus on malicious RTF files delivered to affected Office versions. ↗
• → The vulnerability is triggered by specially crafted RTF files parsed by Microsoft Office; inspect RTF file parsing in Word 2003 SP3, 2007 SP2/SP3, 2010 SP1, Word Viewer, Office Compatibility Pack SP2/SP3, Word Automation Services on SharePoint Server 2010, and Office Web Apps 2010 SP1. ↗

• · Affects a broad range of Microsoft Office products; all listed versions are vulnerable and should be considered in scope for detection rules. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-399