EXPOSURES › CVE-2012-2539
CVE-2012-2539
HIGH ⌖ ON CISA KEV · EXPLOITEDA remote code execution flaw in Microsoft Word allowed attackers to execute arbitrary code via crafted RTF data.
This unpatched RCE vulnerability in Microsoft Word enabled remote code execution, posing a severe risk to DIB organizations relying on Office products. The flaw was actively exploited in the wild, highlighting the danger of known CVEs remaining unpatched. DIBs must ensure all Office components are updated promptly to prevent similar compromises.
Shame score — A known RCE vulnerability in a widely used product like Microsoft Word was actively exploited in the wild, demonstrating the severe impact of unpatched CVEs and the critical need for timely updates.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Word allows attackers to execute remote code or cause a denial-of-service (DoS) via crafted RTF data.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |