Is CVE-2012-2539 (Microsoft Word Remote Code Execution) being exploited in the wild?

How KEV listing changes the answer to “is it being exploited?”

CISA KEV inclusion is the most operationally useful signal here because it moves the question from theoretical vulnerability to confirmed active exploitation. For this kind of Microsoft Word issue, the practical reading is simple: treat KEV status as a trigger for immediate exposure review, not as a reason to wait for local corroboration.

Because the direct answer already says CISA added CVE-2012-2539 on 28 March 2022, the important takeaway is that defenders should assume exploitation pressure exists whenever the vulnerable product remains reachable. That is especially true for document-parsing flaws, where the attack can arrive through ordinary file handling and user interaction.

For background on how to prioritise a known exploited issue, see Zero-Day and Exploited Vulnerabilities Guide, which covers KEV triage, emergency mitigation, and post-patch hunting.

Why a Microsoft Word RTF flaw is operationally dangerous

This vulnerability type matters because the payload is carried in crafted RTF data, which means the risk sits at the boundary between content ingestion and code execution. In practice, that creates a path where opening or processing a malicious document can move directly from user workflow to execution on the endpoint.

The same flaw can also produce denial-of-service outcomes, so the exposure is not limited to compromise of a workstation. In environments that process untrusted documents at scale, a single weak intake path can become both a code-execution risk and a service-availability problem.

If you need a broader view of how document-handling flaws fit into exploit chains, the Insecure Deserialisation Guide is useful because it explains how attacker-controlled data can become execution when parsing assumptions are too permissive.

What to do when patching is delayed or exposure is uncertain

If remediation cannot happen immediately, the safest posture is to reduce document exposure rather than rely on user caution alone. That usually means tightening who can receive external documents, isolating document-processing workflows, and making sure the most exposed systems are not the ones with broad access to sensitive data or administrative tooling.

Before you assume the environment is clean, look for evidence of suspicious document handling, unusual child processes spawned by Word, and unexpected follow-on activity from endpoints that opened untrusted files. When a KEV-listed flaw combines with active exploitation, compromise assessment is part of the response, not an optional follow-up.

For a practical vulnerability triage and verification model, Vulnerability Management Guide is the most relevant internal reference because it covers KEV prioritisation, exceptions, verification, and remediation measurement.

Risk and Threat Considerations

This flaw is risky because it sits in a high-trust application that often handles external content by design. A malicious document can weaponise normal business activity, which makes exposure hard to spot until a process behaves abnormally or an endpoint starts showing signs of post-exploitation activity.

Failure mechanism: Crafted RTF data is parsed by Microsoft Word in a way that can trigger remote code execution or denial of service, so the attacker abuses a routine file-open path rather than needing a separate application exploit.

Impact: Successful exploitation can give an attacker code execution on the endpoint, enable lateral movement if the host is trusted, or disrupt document handling through a DoS condition. In practice, that can turn a single vulnerable desktop or server into a foothold for broader intrusion.

Practitioner Guidance

What to prioritise: Treat every system with Microsoft Word exposure as a candidate for urgent triage, especially if it opens external documents or processes files automatically. If you cannot prove the host is remediated, assume it remains vulnerable until you verify otherwise.

What to verify: Confirm whether the product is present on endpoints that accept untrusted documents, whether those systems have recent suspicious document opens, and whether any security tooling saw follow-on process creation or network activity after file handling. If you have EDR or central logging, use it to backstop the exposure check.

Practitioner takeaway: For KEV-listed document-execution flaws, the right question is not whether exploitation is possible, but whether you have already reduced exposure and checked for signs that someone got there first.

Related resources from NHI Mgmt Group

• How do you patch or mitigate CVE-2012-2539 (Microsoft Word Remote Code Execution)?
• Is CVE-2012-0151 (Microsoft Windows Authenticode Signature Verification Remote Code Execution) being exploited in the wild?
• CVE-2012-2539 (Microsoft Word Remote Code Execution)
• Is CVE-2021-1647 (Microsoft Defender Remote Code Execution) being exploited in the wild?