Highly critical flaw found in Microsoft Excel

The flaw affects multiple versions of Microsoft's Excel spreadsheet software

Microsoft's Excel application contains a vulnerability that could allow a remote attacker to gain access to a system.

The flaw affects multiple versions of the spreadsheet software, including Excel 2000, 2002 and 2003, as well as versions of Microsoft Office containing those versions. It can also be manipulated in Excel Viewer 2003 and Office 2004 for Mac.

"Secunia Research has discovered a vulnerability in Microsoft Excel which can be exploited by malicious people to compromise a user's system," the security website said.

The vulnerability is caused by an error that occurs when validating an index value in the 'rtWnDesk' record. This can be exploited to corrupt memory via a specially crafted Excel Workspace file.

Successful exploitation of the flaw could allow malicious code to be executed on a user's system.

Separately, Microsoft has released details of the first bugs found in the small applications included within Windows Vista.

The company included several fixes for Windows Vista Gadgets in its regular security update on Tuesday.

The flaws, which affect the RSS, Contacts and Weather Gadgets, could allow malicious code to be run on a Vista PC.

"If a user subscribed to a malicious RSS feed in the Feed Headlines Gadget, or added a malicious contacts file in the Contacts Gadget or clicked on a malicious link in the Weather Gadget, an attacker could potentially run code on the system," said Microsoft.