Microsoft Warns of VML Vulnerability

Microsoft has confirmed new public reports of a vulnerability in the Microsoft Windows implementation of Vector Markup Language (VML).

The company is also aware of the public release of detailed exploit code that could be used to exploit this vulnerability. This exploit code could allow an attacker to execute arbitrary code on the user's system. Microsoft is aware that this vulnerability is being actively exploited.

A security update to address this vulnerability is now being finalized through testing and should be released with the monthly update, on Tuesday 10 October 2006. Microsoft does not discard the possibility of this patch being released earlier.

The exploit could be used in malicious web sites, or e-mails. One way around this is to un-register a special DLL with the following command:

regsvr32 /u "%CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll



After the patch is released functionality can be restored with the following command:

regsvr32 "%ProgramFiles%\Common Files\Microsoft Shared\VGX\vgx.dll