Noted bug hunter Georgi Guninski reported the vulnerability on the Bugtraq security mailing list. He said the problem affects Internet Explorer 5.5 and Microsoft´s Outlook and Outlook Express email clients.

The vulnerability exploits ".chm" files, a compressed help file format, Guninski said.

Microsoft could not immediately be reached for comment. In the Bugtraq posting, Guninski said he had notified Microsoft about the security hole Nov. 15.

Read more