CVE-2012-1891

critical · 9.8

Heap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote attackers to execute arbitrary code via crafted XML data that triggers access to an uninitialized object in memory, aka "ADO Cachesize Heap Overflow RCE Vulnerability."

9.8

CVSS

29.4%

EPSS (exploit prob.)

98th

EPSS percentile

2012-07-10

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-119CWE-908

Affected products

Vendor	Product	Affected versions
microsoft	data_access_components	2.8
microsoft	windows_xp	all versions
microsoft	data_access_components	2.8
microsoft	windows_server_2003	all versions
microsoft	windows_xp	all versions
microsoft	windows_data_access_components	6.0
microsoft	windows_7	all versions
microsoft	windows_7	all versions
microsoft	windows_7	all versions
microsoft	windows_7	all versions
microsoft	windows_7	all versions
microsoft	windows_7	all versions
microsoft	windows_7	all versions
microsoft	windows_server_2008	all versions
microsoft	windows_server_2008	all versions
microsoft	windows_server_2008	all versions
microsoft	windows_server_2008	r2
microsoft	windows_server_2008	r2
microsoft	windows_vista	all versions
microsoft	windows_vista	all versions
microsoft	windows_vista	all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2012-1891