Microsoft Security Advisory (972890)
Vulnerability in Microsoft Video ActiveX Control Could Allow Remote Code Execution — Version: 1.0 — Microsoft is investigating a privately reported vulnerability in Microsoft Video ActiveX Control. An attacker who successfully exploited …
Context & Ripple Effects
Microsoft has opened investigation into a privately reported remote code-execution flaw in its Video ActiveX Control, publishing interim advisory 972890 before any patch exists. The Register's same-day headline, 'Windows users ambushed by attack on fresh IE flaw', signals the vulnerability is not merely theoretical — attackers are already driving it through Internet Explorer against Windows users.
This follows a now-familiar rhythm: December 2008 saw Microsoft ship an emergency out-of-band fix for an Internet Explorer zero-day (MS08-078), and February 2009 brought another interim advisory on a PowerPoint-related flaw while fixes were developed. Advisory-first, patch-later has become Microsoft's standard channel when a browser-reachable flaw is being exploited ahead of the monthly cycle.
First-order effects
- Windows users running Internet Explorer are exposed to live remote code-execution attacks right now, since the Video ActiveX Control can be reached from web content; Microsoft's immediate mitigation is disabling the control or setting kill bits rather than a code fix.
- Enterprise administrators must decide between applying workarounds fleet-wide immediately or accepting exposure until the scheduled bulletin, because no patch ships with this advisory.
Second-order effects
- If exploitation widens, the precedent set by the December 2008 out-of-band bulletin points toward Microsoft breaking from Patch Tuesday to ship a fix early — a decision it has made before under identical pressure.
- Antivirus and IPS vendors gain a signature-writing window, filtering exploits at the endpoint while the unpatched control remains the actual attack surface.
Third-order effects
- Each browser-reachable ActiveX flaw strengthens the case that legacy scriptable controls are a structural liability in Windows' attack surface, pushing hardening toward kill-bit defaults and tighter default browser configuration.
- Advisories issued outside the monthly cycle are hardening into a de facto rapid-response tier, normalizing faster vendor disclosure cycles for actively exploited client-side bugs.
The trend: Microsoft's handling of actively exploited browser-component flaws is converging on an advisory-now, out-of-band-patch-if-needed model that keeps compressing the gap between private report and public defense.