CVE-2012-1876
Microsoft Internet Explorer - Code Injection
Title source: ruleDescription
Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka "Col Element Remote Code Execution Vulnerability," as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.
Exploits (9)
exploitdb
WORKING POC
VERIFIED
by ryujin & sickness · htmlremotewindows
https://www.exploit-db.com/exploits/35273
exploitdb
WORKING POC
VERIFIED
by ryujin & sickness · htmlremotewindows
https://www.exploit-db.com/exploits/34815
exploitdb
WORKING POC
VERIFIED
by sickness · htmlremotewindows
https://www.exploit-db.com/exploits/33944
exploitdb
WORKING POC
VERIFIED
by sickness · htmlremotewindows
https://www.exploit-db.com/exploits/24017
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/20174
github
NO CODE
31 stars
by OpenSISE · cpoc
https://github.com/OpenSISE/CVE_PoC_Collect/tree/master/Read_Write_Any_Address/internet explorer/IE9-IE11-Vulnerability-Advanced-Exploitation-master/CVE-2012-1876 Exploitation Demo Code
metasploit
WORKING POC
NORMAL
by Alexandre Pelletier · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms12_037_ie_colspan.rb
References (7)
Scores
EPSS
0.8728
EPSS Percentile
99.5%
Details
CWE
CWE-94
Status
published
Products (4)
microsoft/internet_explorer
6
microsoft/internet_explorer
7
microsoft/internet_explorer
8
microsoft/internet_explorer
9
Published
Jun 12, 2012
Tracked Since
Feb 18, 2026