Only 5 days after the release of the vulnerability, two exploits are on the street. Both exploits, tested on WINXP SP2, will give the attacker the ability to run code of her or his choosing on the compromised machine. As of this writing, a patch has not been made available, as far as we know.

Microsoft is investigating new public reports of a vulnerability in older versions of Microsoft Internet Explorer. Based on our investigation, this vulnerability could allow an attacker to execute arbitrary code on the user’s system in the security context of the logged-on user. The attacker could do this by one or more of the following actions: