Vulnerability · CVE-2012-1889
Microsoft XML Core Services Memory Corruption Vulnerability
Published Jun 12, 2012 · catalog updated Jun 16, 2026 · Microsoft XML Core Services
Patch now
CVE-2012-1889 is in the CISA known-exploited catalog, due Jun 22, 2022. Confirm Microsoft XML Core Services against the vendor advisory and apply that fix. The CVSS score does not change the priority.
- Severity
- High8.8
- Known exploitation
- CISA KEV and VulnCheck KEV
- EPSS
- 83.52%
- Remediation
- Remediation guidance
- Affected products
- cpe microsoft/xml core services · vendor Microsoft XML Core Services · vendor n/a n/a
Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- cpe microsoft/xml core services3.0
- cpe microsoft/xml core services4.0
- cpe microsoft/xml core services5.0
- cpe microsoft/xml core services6.0
- vendor Microsoft XML Core Servicesversion unspecified
- vendor n/a n/aversion unspecified
How to fix CVE-2012-1889
Recommended remediation
Apply updates per vendor instructions. CISA due date Jun 22, 2022.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
CVE-2012-1889 is in the CISA known-exploited catalog, due Jun 22, 2022. Confirm Microsoft XML Core Services against the vendor advisory and apply that fix. The CVSS score does not change the priority.
Which versions are affected?
Compare what you have installed with microsoft/xml core services 3.0; microsoft/xml core services 4.0; microsoft/xml core services 5.0; microsoft/xml core services 6.0. Apply updates per vendor instructions.
What should an analyst verify?
CWE-119: Buffer Overflow; CWE-787: Out-of-bounds Write. EPSS 83.52%. The CISA KEV listing is the exploitation evidence. A public exploit reference is linked in Sources. That is not the same as confirmed exploitation. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Jun 12, 2012 · Catalog
Detected
Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Jun 8, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jun 22, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Sources
- CISA KEVConfirmed exploitationCVE-2012-1889
Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution.
cisa.gov - CVE.orgVulnerability recordCVE-2012-1889
Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
cve.org - FIRST EPSSExploitation probabilityCVE-2012-1889
30-day exploitation probability 83.5%
first.org - Exploit DatabasePublic exploit reference19186
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit ModulesPublic exploit moduleexploit_windows/browser/msxml_get_definition_code_exec
Public module reference (good). Module source is not copied into this catalog.
rapid7.com - NIST NVDVulnerability recordCVE-2012-1889
Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
nvd.nist.gov - VulnCheck KEVConfirmed exploitationCVE-2012-1889
Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution.
vulncheck.com
References
- Vendor Advisory · technet.microsoft.com
- VulnCheck exploitation evidence · cs.cornell.edu
- Third Party Advisory · us-cert.gov
- Third Party Advisory · us-cert.gov
- VulnCheck exploitation evidence · cisa.gov
- VulnCheck exploitation evidence · cisa.gov
- VulnCheck exploitation evidence · cybersecurity.att.com
- Patch · docs.microsoft.com
- CISA note · nvd.nist.gov
- Broken Link · oval.cisecurity.org
- VulnCheck exploitation evidence · paper.seebug.org
- VulnCheck exploitation evidence · recordedfuture.com
Freshness
Last verified in this catalog Oct 17, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.