CVE-2012-1876

Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle...

9.3 HighPublic exploit

Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka "Col Element Remote Code Execution Vulnerability," as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.

Exploit likelihood

65.0%Down 26.9 points since Feb 4, 2022

What each source reports

NVD Score used 9.3

Record: CVE-2012-1876
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-94
Updated: 2026-11-02

CVE List No score

Record: CVE-2012-1876
Updated: 2026-11-02

EUVDEUVD-2012-1886 No score

Record: EUVD-2012-1886
Updated: 2026-11-03

GitHub AdvisoriesGHSA-mj6r-fxqr-4c2f No score

Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle...

Record: GHSA-mj6r-fxqr-4c2f
Weakness: CWE-94
Updated: 2026-11-02

Affected products

microsoft internet explorer

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Microsoft Internet Explorer - Fixed Table Col Span Heap Overflow (MS12-037) (Metasploit)	2012-08-02
Exploit-DB	Microsoft Internet Explorer 8 - Fixed Col Span ID (Full ASLR + DEP Bypass) (MS12-037)	2013-01-10
Exploit-DB	Microsoft Internet Explorer 8 - Fixed Col Span ID (Full ASLR + DEP + EMET 4.1.x Bypass) (MS12-037)	2014-07-01
Exploit-DB	Microsoft Internet Explorer 8 - Fixed Col Span ID (Full ASLR + DEP + EMET 5.0 Bypass) (MS12-037)	2014-09-29
Exploit-DB	Microsoft Internet Explorer 8 - Fixed Col Span ID (Full ASLR + DEP + EMET 5.1 Bypass) (MS12-037)	2014-11-17
Metasploit	MS12-037 Microsoft Internet Explorer Fixed Table Col Span Heap Overflow	2012-06-12
PoC in GitHub	ExploitCN/CVE-2012-1876-win7_x86_and_win7x64	2022-02-08
PoC in GitHub	WizardVan/CVE-2012-1876	2015-05-03

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-1876 is a high vulnerability (CVSS 9.3) in Microsoft Internet Explorer, published June 12, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 65.0%, the 99th percentile. No source names a fixed version.