KEV 2012

Microsoft VBA — DLL Hijacking via Untrusted Search Path in Office Applications

Microsoft Internet Explorer — CDwnBindInfo Use-After-Free Zero-Day Used in Water-Holing Against US Foreign Policy Community

Microsoft XML Core Services (MSXML) — Zero-Day Use-After-Free in XML Parsing Exploited via IE and Office Before Patch

Adobe Flash Player — Matrix3D Integer Overflow Enables Remote Code Execution via Malformed Flash Arguments

Adobe Flash Player — MP4 Atom Parsing Out-of-Bounds Write Exploited in Targeted Attacks Against Activists

Microsoft Internet Explorer — Zero-Day Use-After-Free in IE 6–9 Exploited via Drive-By Before Emergency Patch

Microsoft Windows — WinVerifyTrust Digest Validation Flaw Allows Code Execution via Tampered Signed PE Files

Microsoft Office MSCOMCTL.OCX — TabStrip ActiveX System-State Corruption Enables RCE via Documents or Web Pages

Microsoft Word — Out-of-Bounds Write in RTF Parsing Enables Code Execution via Crafted Documents

Adobe Flash Player — Zero-Day Exploited via Flash Embedded in Word Documents in Targeted Spear-Phishing

Adobe Flash Player — Heap Memory Corruption Exploited via Malicious SWF Content in Targeted Attacks

Microsoft MSCOMCTL.OCX — ListView/TreeView ActiveX Stack Overflow, the Most Exploited Office CVE of the Decade