CVE-2012-2539
published 2012-12-12CVE-2012-2539: Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote…
PriorityP181high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2022-04-18
Exploited in the wild
EPSS
53.16%
98.9th percentile
Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka "Word RTF 'listoverridecount' Remote Code Execution Vulnerability."
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | office_web_apps | — | — |
| microsoft | sharepoint_server | — | — |
| microsoft | word | — | — |
| microsoft | word | — | — |
| microsoft | word | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Microsoft Rich Text File .RTF File download with invalid listoverridecount"; flow:established,to_client; file.data; content:"|5c|listoverridetable"; distance:0; content:"|5c|listoverride|5c|"; fast_pattern; content:"|5c|listoverridecount"; isdataat:2,relative; pcre:"/^(?:0*?[19]\d|[^190])/R"; reference:cve,2012-2539; classtype:attempted-user; sid:2018315; rev:7; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2012_12_12, cve CVE_2012_2539, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2024_03_13;)
- →The exploitation vector is the RTF `\listoverridecount` field. Only values 0, 1, or 9 are legal; any other value indicates a potentially malicious or malformed document exploiting CVE-2012-2539. ↗
- →Detect RTF files containing `\listoverridetable` followed by `\listoverride\` and `\listoverridecount` with a value that does not match 0, 1, or 9 (regex: `/^(?:0*?[19]\d|[^190])/R`).
- →The vulnerability is triggered via crafted RTF data delivered to Microsoft Word; network-level detection should focus on HTTP responses delivering RTF files with invalid `listoverridecount` values (flow: established, to_client).
- →The Snort rule message string 'listoverridecount' in the rule message can be used to identify existing coverage and correlate alerts to this CVE. ↗
- ·Some legitimate RTF-generating software may produce `\listoverridecount` values outside 0, 1, or 9, leading to false positives. The ClamAV signature was temporarily converted to a PUA signature for this reason before being re-enabled. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck7.8HIGH
cisa7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft Word Remote Code Execution Vulnerability
cisa·2022-03-28·CVSS 7.8
CVE-2012-2539 [HIGH] CWE-399 Microsoft Word Remote Code Execution Vulnerability
Vulnerability: Microsoft Word Remote Code Execution Vulnerability
Affected: Microsoft Word
Microsoft Word allows attackers to execute remote code or cause a denial-of-service (DoS) via crafted RTF data.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2012-2539
Remediation Due Date: 2022-04-18
GHSA
GHSA-x5wq-5f2r-gxw5: Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote
ghsa_unreviewed·2022-05-14
CVE-2012-2539 [HIGH] CWE-787 GHSA-x5wq-5f2r-gxw5: Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote
Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka "Word RTF 'listoverridecount' Remote Code Execution Vulnerability."
VulnCheck
Microsoft Word Remote Code Execution Vulnerability
vulncheck·2012·CVSS 7.8
CVE-2012-2539 [HIGH] CWE-399 Microsoft Word Remote Code Execution Vulnerability
Microsoft Word Remote Code Execution Vulnerability
Microsoft Word allows attackers to execute remote code or cause a denial-of-service (DoS) via crafted RTF data.
Affected: Microsoft Word
Required Action: Apply updates per vendor instructions.
Exploitation References: https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/2014.07.11.Pitty_Tiger/Pitty_Tiger_Final_Report.pdf; https://www.group-ib.com/resources/threat-research/Anunak_APT_against_financial_institutions.pdf; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2022-04-18
Suricata
ET WEB_CLIENT Microsoft Rich Text File .RTF File download with invalid listoverridecount
suricata·2012-12-12
CVE-2012-2539 ET WEB_CLIENT Microsoft Rich Text File .RTF File download with invalid listoverridecount
ET WEB_CLIENT Microsoft Rich Text File .RTF File download with invalid listoverridecount
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Microsoft Rich Text File .RTF File download with invalid listoverridecount"; flow:established,to_client; file.data; content:"|5c|listoverridetable"; distance:0; content:"|5c|listoverride|5c|"; fast_pattern; content:"|5c|listoverridecount"; isdataat:2,relative; pcre:"/^(?:0*?[19]\d|[^190])/R"; reference:cve,2012-2539; classtype:attempted-user; sid:2018315; rev:7; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2012_12_12, cve CVE_2012_2539, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2024_03_13;)
No public exploits indexed.
Talos
CVE-2014-1761, Oh did you mean CVE-2012-2539?
blogs_talos·2014-04-08·CVSS 8.8
CVE-2014-1761 [HIGH] CVE-2014-1761, Oh did you mean CVE-2012-2539?
When the VRT first received word of a new Microsoft Word 0-day I anxiously awaited details and the ever important hash of the in-the-wild exploit to be able to research it and provide coverage through Snort, ClamAV and the FireAmp suite of products. I was especially interested when word came that it was an RTF vulnerability, as I have spent a lot of time looking at high profile RTF vulnerabilities such as the ever popular CVE-2012-0158.
When the in the wild sample finally arrived I thought someone was playing an early April Fool's joke on us: I knew this vulnerability already. More than that, I had written the coverage for this almost a year and half ago! The vulnerability appeared to be CVE-2012-2539, which was released December 11th 2012 as Microsoft Security Bulletin MS12-079. I checke
Talos
CVE-2014-1761, Oh did you mean CVE-2012-2539?
blogs_talos·2014-04-08·CVSS 8.8
CVE-2014-1761 [HIGH] CVE-2014-1761, Oh did you mean CVE-2012-2539?
## CVE-2014-1761, Oh did you mean CVE-2012-2539?
When the VRT first received word of a new Microsoft Word 0-day I anxiously awaited details and the ever important hash of the in-the-wild exploit to be able to research it and provide coverage through Snort, ClamAV and the FireAmp suite of products. I was especially interested when word came that it was an RTF vulnerability, as I have spent a lot of time looking at high profile RTF vulnerabilities such as the ever popular CVE-2012-0158.
When the in the wild sample finally arrived I thought someone was playing an early April Fool's joke on us: I knew this vulnerability already. More than that, I had written the coverage for this almost a year and half ago! The vulnerability appeared to be CVE-2012-2539, which was released December 11th 2012
Zscaler
Zscaler Protects against Microsoft's Patch Cycle | Round 2
blogs_zscaler·CVSS 9.0
[CRITICAL] Zscaler Protects against Microsoft's Patch Cycle | Round 2
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
http://www.us-cert.gov/cas/techalerts/TA12-346A.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-079https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16073http://www.us-cert.gov/cas/techalerts/TA12-346A.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-079https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16073https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-2539
2012-12-12
Published
2022-03-28
Added to CISA KEV
Exploited in the wild