CVE-2012-1889

Published: Jun 13, 2012Modified: Apr 22, 2026CISA KEV

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

Affected (4)

Products: Microsoft: Xml Core Services

Microsoft

1 product

Xml Core Services

Configuration A

3 vulnerable · 11 platform

Vulnerable Software	Affected Versions
Microsoft Xml Core Services	Version 3.0
Microsoft Xml Core Services	Version 4.0
Microsoft Xml Core Services	Version 6.0

Running on/with	Platform Versions
Microsoft Windows 7	All versions
Microsoft Windows 7	All versions
Microsoft Windows 8	All versions
Microsoft Windows Server 2003	All versions
Microsoft Windows Server 2003	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	Version r2
Microsoft Windows Server 2008	Version r2 sp1
Microsoft Windows Server 2012	All versions
Microsoft Windows Vista	All versions
Microsoft Windows Xp	All versions

Configuration B

1 vulnerable · 14 platform

Vulnerable Software	Affected Versions
Microsoft Xml Core Services	Version 5.0

Running on/with	Platform Versions
Microsoft Expression Web	Version 2
Microsoft Expression Web	Version sp1
Microsoft Groove	Version 2007 sp2
Microsoft Groove	Version 2007 sp3
Microsoft Groove Server	Version 2007 sp2
Microsoft Groove Server	Version 2007 sp3
Microsoft Office	Version 2003 sp3
Microsoft Office	Version 2007 sp2
Microsoft Office	Version 2007 sp3
Microsoft Office Compatibility Pack	All versions
Microsoft Office Compatibility Pack	All versions
Microsoft Office Word Viewer	All versions
Microsoft Sharepoint Server	Version 2007 sp2
Microsoft Sharepoint Server	Version 2007 sp3