Skip to content
Fencer Intel
critical 9.3

CVE-2012-10043 json

ActFax 4.32 Client Importer Buffer Overflow

published 2025-08-08 15 mo ago modified 2026-06-16 4 mo ago also EUVD-2012-6591

cvss
9.3
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
1
Metasploit

Summary

A stack-based buffer overflow vulnerability exists in ActFax Server version 4.32, specifically in the "Import Users from File" functionality of the client interface. The application fails to properly validate the length of tab-delimited fields in .exp files, leading to unsafe usage of strcpy() during CSV parsing. An attacker can exploit this vulnerability by crafting a malicious .exp file and importing it using the default character set "ECMA-94 / Latin 1 (ISO 8859)". Successful exploitation may result in arbitrary code execution, leading to full system compromise. User interaction is required to trigger the vulnerability.

Timeline

  1. First public exploit (Metasploit exploit/windows/fileformat/actfax_import_users_bof)
  2. Published

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
15 mo ago

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/windows/fileformat/actfax_import_users_bof ActiveFax (ActFax) 4.3 Client Importer Buffer Overflow metasploit exploit, normal rank, 2012-08-28
  • raw.githubusercontent.com https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/actfax_import_users_bof.rb referenced PoC, tagged "exploit" by a source, unverified
  • exploit-db.com https://www.exploit-db.com/exploits/20915 referenced PoC, tagged "exploit" by a source, unverified
  • web.archive.org https://web.archive.org/web/20130712072809/http://www.pwnag3.com/2012/08/actfax-local-privilege-escalation.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 9.3 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA 4.0 9.3 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • ActFax Server

Classification

Weakness
  • CWE-121 Stack-based Buffer Overflow

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.