CVE-2012-1876

Microsoft Internet Explorer - Code Injection

Title source: rule

Description

Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka "Col Element Remote Code Execution Vulnerability," as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.

Exploits (9)

exploitdb WORKING POC VERIFIED
by ryujin & sickness · htmlremotewindows
https://www.exploit-db.com/exploits/35273
exploitdb WORKING POC VERIFIED
by ryujin & sickness · htmlremotewindows
https://www.exploit-db.com/exploits/34815
exploitdb WORKING POC VERIFIED
by sickness · htmlremotewindows
https://www.exploit-db.com/exploits/33944
exploitdb WORKING POC VERIFIED
by sickness · htmlremotewindows
https://www.exploit-db.com/exploits/24017
exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/20174
nomisec NO CODE
by ExploitCN · poc
https://github.com/ExploitCN/CVE-2012-1876-win7_x86_and_win7x64
nomisec STUB
by WizardVan · poc
https://github.com/WizardVan/CVE-2012-1876
metasploit WORKING POC NORMAL
by Alexandre Pelletier · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms12_037_ie_colspan.rb

Scores

EPSS 0.8728
EPSS Percentile 99.5%

Details

CWE
CWE-94
Status published
Products (4)
microsoft/internet_explorer 6
microsoft/internet_explorer 7
microsoft/internet_explorer 8
microsoft/internet_explorer 9
Published Jun 12, 2012
Tracked Since Feb 18, 2026