The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."
Data as of 2 Nov 2026 · NVD, CISA KEV, EPSS
Defenders still triage vulnerabilities one CVE at a time, while increasingly automated attackers combine them at machine speed. Omenwave models the plausible pathways by which this CVE could be chained with others — surfacing them for research and awareness, with evidence for each step.
The source lands the attacker on the host (code execution or an established foothold), which satisfies the destination's requirement for local access.
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an…
The source lands the attacker on the host (code execution or an established foothold), which satisfies the destination's requirement for local access.
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2…
The source lands the attacker on the host (code execution or an established foothold), which satisfies the destination's requirement for local access.
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Auto…
The source lands the attacker on the host (code execution or an established foothold), which satisfies the destination's requirement for local access.
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulne…
The source lands the attacker on the host (code execution or an established foothold), which satisfies the destination's requirement for local access.
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Exe…
Modelled plausible chaining potential derived from public CVE metadata (CVSS, CWE, CPE). Not a confirmed real-world exploit chain and contains no exploitation detail. For research and awareness only.
Methodology · Interactive explorer · JSON: /cve/CVE-2012-0158