CVE-2012-1856

A 12-year-old unpatched Microsoft Office ActiveX vulnerability in MSCOMCTL.OCX allows remote attackers to execute arbitrary code via crafted documents or web pages.

This long-standing unpatched vulnerability in Microsoft Office's MSCOMCTL.OCX component enables remote code execution through malicious documents or web pages, directly impacting DIB organizations reliant on Office for daily operations. The fact that it remained unpatched for over a decade demonstrates severe negligence in patch management and software lifecycle oversight. DIBs must rigorously validate their patching cadences and assume that legacy components in widely deployed software can be actively exploited in the wild.

Shame score — A critical remote code execution flaw remained unpatched for over a decade, representing extreme negligence and a massive, avoidable security gap that was eventually added to the KEV catalog.