Microsoft Office and VBA VBE6.dll Untrusted Search Path Vulnerability (CVE-2012-1854) Advisory

1. Apply Official Security Patches

Refer to Microsoft Security Bulletin MS12-046 and apply the appropriate security updates for your specific Office and VBA versions.

2. Temporary Mitigation via Registry

Restrict DLL loading from the Current Working Directory (CWD) by configuring the CWDIllegalInDllSearch registry key.

# Run in Administrator Command Prompt
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v CWDIllegalInDllSearch /t REG_DWORD /d 1 /f

*Note: Setting the value to 1 blocks DLL loading from WebDAV and network shares.*

3. Defensive Best Practices

• Avoid opening Office documents directly from untrusted network shares or extracted archives containing unrecognized DLL files.
• Deploy Endpoint Detection and Response (EDR) rules to monitor and block Office applications (winword.exe, excel.exe, etc.) from loading DLLs from non-standard directories.

This vulnerability (CVE-2012-1854) is an untrusted search path vulnerability (CWE-426, DLL Hijacking) residing in VBE6.dll, a core component of Microsoft Visual Basic for Applications (VBA).

The root cause lies in the application's insecure DLL search order, where it attempts to load required libraries from the Current Working Directory (CWD) before searching secure system directories. An attacker can exploit this by placing a Trojan horse DLL alongside a legitimate Office document (such as a .docx file) in a shared network folder or a local directory. When the victim opens the document, the VBA engine initializes and inadvertently loads the malicious DLL from the same directory, executing arbitrary code under the context of the current user.

This vulnerability has been actively exploited in the wild (listed in CISA KEV) and carries a high EPSS score of 0.94, indicating an extremely high likelihood of exploitation in unpatched environments.