CVE-2012-1661

ESRI ArcMap < 10.0.2.3200 - Arbitrary VBA Code Execution via Crafted Map File

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2012-1661. PoCs published by Boston Cyber Defense.

AI-analyzed exploit summary This exploit leverages a flaw in ESRI ArcMap's handling of embedded VBA macros in .mxd files, allowing arbitrary code execution without user prompt. The PoC demonstrates execution of shell commands via a crafted macro.

Description

ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assisted remote attackers to execute arbitrary VBA code via a crafted map (.mxd) file.

Exploits (1)

exploitdb WORKING POC
by Boston Cyber Defense · textlocalwindows
https://www.exploit-db.com/exploits/19138

This exploit leverages a flaw in ESRI ArcMap's handling of embedded VBA macros in .mxd files, allowing arbitrary code execution without user prompt. The PoC demonstrates execution of shell commands via a crafted macro.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: ESRI ArcMap 9, ArcGIS Desktop 10 (builds 10.0.1.2800, 10.0.2.3200)
No auth needed
Prerequisites: User interaction to open a malicious .mxd file
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/19138
Exploit, Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1027170
Broken Link vdb-entry x_refsource_osvdb
http://www.osvdb.org/82986

Scores

EPSS 0.2383
EPSS Percentile 97.5%

Details

CWE
CWE-94
Status published
Products (1)
esri/arcmap < 10.0.2.3200
Published Jul 12, 2012
Tracked Since Feb 18, 2026