This critical vulnerability in Microsoft Visual Basic for Applications is confirmed to be actively exploited in the wild and allows attackers to achieve arbitrary code execution via DLL hijacking.

The vulnerability is an untrusted search path flaw in VBE6.dll, which allows local attackers to load a malicious DLL when a user opens a document from a directory containing that DLL. This process requires user interaction, but it does not require authentication to trigger the execution of malicious code within the context of the application.

Successful exploitation leads to full system compromise, as the attacker can install programs, view or modify sensitive data, or create new accounts with administrative privileges. With a CVSS score of 9.5, this vulnerability represents a severe threat to organizational security. The risk is significantly elevated due to its presence in the CISA Known Exploited Vulnerabilities catalog, confirming that adversaries are actively leveraging this technique to bypass security controls in legacy Office environments.

Immediate Action: Apply the updates provided in Microsoft Security Bulletin MS12-046, including patches KB2596744, KB2598243, KB2553447, KB2687626, and KB2688865, to address the vulnerability in the affected VBA runtimes.

Proactive Monitoring: Monitor file system activity for the creation of unexpected DLL files in directories containing Office documents, and review endpoint logs for unauthorized process execution originating from Office applications.

Compensating Controls: Implement policies that restrict the execution of untrusted files from external sources or network shares, and ensure that users operate with the principle of least privilege to limit the impact of a potential compromise.

Public Exploit Available: Yes, as documented in the Microsoft Security Bulletin MS12-046 and associated technical advisories regarding the DLL hijacking technique.

Given the critical severity of this vulnerability and its confirmed status in the CISA Known Exploited Vulnerabilities catalog, immediate patching is mandatory for any remaining legacy systems running Microsoft Office 2003, 2007, or 2010. Organizations must prioritize the deployment of the KB updates listed in MS12-046 to eliminate the insecure search path and protect against ongoing exploitation attempts. Failure to remediate this flaw exposes the network to trivial privilege escalation and persistent unauthorized access.