Microsoft Visual Basic For Applications vulnerabilities

2 CVEs affecting Microsoft Visual Basic For Applications, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-1854, published 2012-07-10.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2012-1854: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability, published 2012-07-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-04-13. EPSS: 20.9% chance of exploitation in the next 30 days. Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic…
• CVE-2010-0815, published 2010-05-12. High severity, CVSS 9.3. EPSS: 22.4% chance of exploitation in the next 30 days. VBE6.DLL in Microsoft Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Visual Basic for Applications (VBA), and VBA SDK 6.3 through 6.5 does not properly search for ActiveX…