The vulnerability, which affects all supported versions of IE, lies in the browser's data binding function. According to Microsoft, when data binding is enabled—which it is by default—it is possible under certain conditions for an object to be released without updating the array length. This makes it possible to access the deleted object's memory space and cause the browser to exit unexpectedly in a state that is exploitable.

"At this time, we are aware only of attacks that attempt to use this vulnerability against Windows Internet Explorer 7," Christopher Budd, Microsoft's Security Response Communications lead, said in a statement. "Microsoft encourages customers to test and deploy this update as soon as possible."

In the meantime, Microsoft has made information available about a number of workarounds and mitigations for IE users.

Read the rest of this article on eWEEK.com.