Visual Basic for Applications Insecure Library Loading Vulnerability

CVE-2012-1854 is an insecure library loading / untrusted search path vulnerability in Microsoft Visual Basic for Applications (VBA), specifically involving VBE6.dll as used by Microsoft Office 2003 SP3, Office 2007 SP2/SP3, Office 2010 Gold/SP1, VBA, and Summit Microsoft Visual Basic for Applications SDK. VBA incorrectly restricts the path used for loading external libraries, allowing a malicious DLL placed in the current working directory or other attacker-controlled location to be loaded instead of the intended library. Microsoft described exploitation as possible when a user opens a legitimate Microsoft Office file from the same directory as a specially crafted DLL, including scenarios involving local directories, network shares, UNC paths, or WebDAV locations. This issue is also referred to as the "Visual Basic for Applications Insecure Library Loading Vulnerability." Microsoft reported public disclosure and limited, targeted exploitation in the wild at the time of its 2012 advisory.