Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Windows XP/7/Server can run malicious ClickOnce apps

CVE-2012-0013 · published 14 years ago
Summary

Certain versions of Windows (XP, Vista, Server 2003, Server 2008, Windows 7) may let a specially crafted Office document launch a ClickOnce application that runs any code the attacker chooses. This could let an attacker take control of a computer from afar. Install the latest security updates from Microsoft or apply the supplied patches to protect the system.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft windows_7 All versions
cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*
microsoft windows_server_2003 All versions
cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
microsoft windows_server_2008 r2
cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x32:*:*:*:*:*
microsoft windows_vista All versions
cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*
microsoft windows_xp All versions
cpe:2.3:o:microsoft:windows_xp:*:sp2:professional_x64:*:*:*:*:*
Original advisory text
Incomplete blacklist vulnerability in the Windows Packager configuration in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, an...
Incomplete blacklist vulnerability in the Windows Packager configuration in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted ClickOnce application in a Microsoft Office document, related to .application files, aka "Assembly Execution Vulnerability."
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
74% chance of attack within 30 days
Timeline
Published10 Jan 2012
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2012-0013 · NVD
Track software like this
Free during beta