Microsoft Visual Basic vulnerabilities

19 CVEs affecting Microsoft Visual Basic, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-1856, published 2012-08-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2012-0158: Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability, published 2012-04-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 100% chance of exploitation in the next 30 days. The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office…
CVE-2012-1856: Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability, published 2012-08-15. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 72% chance of exploitation in the next 30 days. The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL…
CVE-2008-3704, published 2008-08-18. High severity, CVSS 9.3. EPSS: 55.9% chance of exploitation in the next 30 days. Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio…
CVE-2003-0347, published 2003-10-20. High severity, CVSS 10.0. EPSS: 54.9% chance of exploitation in the next 30 days. Heap-based buffer overflow in VBE.DLL and VBE6.DLL of Microsoft Visual Basic for Applications (VBA) SDK 5.0 through 6.3 allows remote attackers to execute arbitrary code via a document with a long ID…
CVE-2008-4255, published 2008-12-10. High severity, CVSS 9.3. EPSS: 53.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, Visual…
CVE-2004-0200, published 2004-09-28. High severity, CVSS 9.3. EPSS: 49% chance of exploitation in the next 30 days. Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with…
CVE-2007-4776, published 2007-09-10. High severity, CVSS 9.3. EPSS: 49% chance of exploitation in the next 30 days. Buffer overflow in Microsoft Visual Basic 6.0 and Enterprise Edition 6.0 SP6 allows user-assisted remote attackers to execute arbitrary code via a Visual Basic project (vbp) file containing a long…
CVE-2007-0065, published 2008-02-12. High severity, CVSS 10.0. EPSS: 43.2% chance of exploitation in the next 30 days. Heap-based buffer overflow in Object Linking and Embedding (OLE) Automation in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, Office 2004 for Mac, and Visual basic 6.0 SP6 allows…
CVE-2007-2884, published 2007-05-30. High severity, CVSS 9.3. EPSS: 36.2% chance of exploitation in the next 30 days. Multiple stack-based buffer overflows in Microsoft Visual Basic 6 allow user-assisted remote attackers to cause a denial of service (CPU consumption) or execute arbitrary code via a Visual Basic…
CVE-2007-2224, published 2007-08-14. High severity, CVSS 9.3. EPSS: 34.5% chance of exploitation in the next 30 days. Object linking and embedding (OLE) Automation, as used in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Office 2004 for Mac, and Visual Basic 6.0 allows remote attackers to execute…

Latest

CVE-2008-4256, published 2008-12-10. High severity, CVSS 8.5. EPSS: 21% chance of exploitation in the next 30 days. The Charts ActiveX control in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors during access to…
CVE-2008-4254, published 2008-12-10. High severity, CVSS 8.5. EPSS: 22.1% chance of exploitation in the next 30 days. Multiple integer overflows in the Hierarchical FlexGrid ActiveX control (mshflxgd.ocx) in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allow remote attackers to execute…
CVE-2008-4253, published 2008-12-10. High severity, CVSS 8.5. EPSS: 21% chance of exploitation in the next 30 days. The FlexGrid ActiveX control in Microsoft Visual Basic 6.0, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, Office FrontPage 2002 SP3, and Office Project 2003 SP3 does not properly handle errors during…
CVE-2008-4252, published 2008-12-10. High severity, CVSS 8.5. EPSS: 21% chance of exploitation in the next 30 days. The DataGrid ActiveX control in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors during access to incorrectly initialized objects, which allows…
CVE-2008-0392, published 2008-01-23. High severity, CVSS 9.3. EPSS: 30.5% chance of exploitation in the next 30 days. Multiple buffer overflows in Microsoft Visual Basic Enterprise Edition 6.0 SP6 allow user-assisted remote attackers to execute arbitrary code via a .dsr file with a long (1) ConnectionName or (2)…