Microsoft XML Core Services Memory Corruption Vulnerability

HIGH 8.8EXPLOITED (CISA KEV)CVE-2012-1889 · Published 13/06/2012 · updated 16/06/2026

Microsoft XML Core Services Memory Corruption Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 08/06/2022. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
xml core services microsoft	`= 3.0= 4.0= 5.0= 6.0`	No fix yet

Description

Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

References

technet.microsoft.com/security/advisory/2719615 · Vendor Advisory
us-cert.gov/cas/techalerts/TA12-174A.html · Third Party Advisory
us-cert.gov/cas/techalerts/TA12-192A.html · Third Party Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-043 · Patch
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15195 · Broken Link
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2012-1889

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free