Authenticated code execution via undisclosed control flaw

Code injection in Microsoft Windows WebBrowser Control allows remote authenticated users to execute code through a network-based attack. Microsoft has not disclosed the flawed function, input format, or code-generation operation that processes attacker-controlled data. Any authenticated user can trigger the flaw, but exploitation requires additional preparation of the target environment; code executes with the control process's privileges.