CVE-2012-1889 is a critical uninitialized memory vulnerability affecting Microsoft XML Core Services versions 3.0, 4.0, 5.0, and 6.0. This flaw allows remote attackers to execute arbitrary code or cause a denial of service by tricking users into visiting a crafted website. With a CVSS score of 8.8 (High), it presents a significant risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. This vulnerability has been actively exploited in the wild, with public Metasploit modules available and extensive community discussion and media coverage, indicating its widespread recognition and use by threat actors.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
3.0CPE matchmatch criteria | cpe:2.3:a:microsoft:xml_core_services:3.0:*:*:*:*:*:*:* | ||
4.0CPE matchmatch criteria | cpe:2.3:a:microsoft:xml_core_services:4.0:*:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:a:microsoft:xml_core_services:6.0:*:*:*:*:*:*:* | ||
5.0CPE matchmatch criteria | cpe:2.3:a:microsoft:xml_core_services:5.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.