CVE-2012-0003

high

Published 2012-01-10 · Modified 2026-04-29

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

8.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v4 NEW

—

not yet in upstream

VIR risk

9.1

Description

Unspecified vulnerability in winmm.dll in Windows Multimedia Library in Windows Media Player (WMP) in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows remote attackers to execute arbitrary code via a crafted MIDI file, aka "MIDI Remote Code Execution Vulnerability."

Predictions

Exploit likelihood

88%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-18426 remote windows verified

Metasploit · 2012-01-28

Microsoft Windows - midiOutPlayNextPolyEvent Heap Overflow (MS12-004) (Metasploit)

Source code queued for fetch — refresh in a moment.

Metasploit modules

exploit_windows/browser/ms12_004_midi rank 300

MS12-004 midiOutPlayNextPolyEvent Heap Overflow

Source fetch failed: fetch_error — view the original via the link above.

OS impact

Windows Affected 4 releases

Version	Status	Fixed in
r2	Affected	—
2005	Affected	—
-	Affected	—
—	Affected	—

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.