Microsoft has announced that a critical code execution vulnerability in Microsoft Video ActiveX Control can enable attackers to run arbitrary code if users browse to a malicious website. It has been confirmed that a growing number of attacks are currently exploiting the flaw.

This vulnerability affects users with Internet Explorer 6 and 7 on Windows Server 2003 and Windows XP, while Vista and Server 2008 users are not affected. The affected component is part of Microsoft DirectShow, and is installed by default with Windows XP.

Microsoft is working to develop a security update to address this issue. eSafe users, however, are protected against this issue and its resulting security threats.

Additional information is available in this Microsoft Security Advisory.

Update: 15/07/2009 - Microsoft has addressed this vulnerability with Microsoft Security Bulletin MS09-032. Mitre's CVE ID: CVE-2008-0015.