"Today we release Security Advisory 2490606, which addresses a publicly disclosed vulnerability affecting Microsoft Windows Graphics Rendering Engine on Vista, Server 2003, and Windows XP. The vulnerability does not affect Windows 7 or Windows Server 2008 R2, the newest versions of our operating system," blogged Angela Gunn, senior marketing communications manager of Trustworthy Computing at Microsoft.

 

According to Gunn, for an attacker to take advantage of the vulnerability they would either have to convince a user to visit a malicious website specifically created for the task, or they would have to convince them to open an infected Word or PowerPoint (or similar) file. "Furthermore, users whose accounts are configured to have fewer user rights on the system would be less affected by an attack than those running with administrative rights. The Advisory includes further mitigations and workarounds to protect our customers," said Gunn.

 

Microsoft has stated that at this time it has detected no attempts to take advantage of the vulnerability, and that no impact has been seen with users thus far. The company is working on a solution to the problem. For now we'd recommend not opening any weird files you find in your email inbox, and not straying to any suspiciously linked websites.

 

The full list of affected operating systems include Windows XP SP3 (service pack), XP Professional x64 Edition SP2, Server 2003 SP2, Server 2003 x64 Edition SP2, Server 2003 with SP2 for Itanium-based systems, Vista SP1 and SP2, Vista x64 Edition SP1 and SP2 and Server 2008 32-bit and 64-bit editions. Windows 7 systems are not affected.