CVE-2012-1889
Microsoft XML Core Services Memory Corruption Vulnerability
- Published
- Jun 13, 2012
- Updated
- Oct 22, 2025
- Assigning CNA
- microsoft
- Evidence observed
- Jun 16, 2012
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.7%
- Model date
- Oct 15, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Sources
modules/exploits/windows/browser/msxml_get_definition_code_exec.rb
Metasploit Framework modulesDeclared conditions
- platform: Windows($.exploit_windows/browser/msxml_get_definition_code_exec.platform)
- verification: check_not_declared($.exploit_windows/browser/msxml_get_definition_code_exec.check)
- CVE-2012-1889Exploit
这里保存着我学习CVE-2012-1889这个漏洞的利用所用到的文件
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.