The flaw affects a part of the Microsoft XML Core Services 4.0, referred to as the XMLHTTP 4.0 ActiveX Control.
The Core Service technology provides interoperability between applications based on the XML 1.0 standard and Microsoft's Jscript, VBScript and Visual Studio 6.0 programming environments.
Attackers could exploit the flaw to take control of a system by luring victims to a specially crafted website or a page on a social service such as MySpace.
Microsoft said that it is aware of "limited attacks" exploiting the flaw, but did not provide a security rating.
Alex Eckelberry, a president with security vendor Sunbelt Software, downplayed the threat. The company has detected only one site exploiting the flaw so far, and claimed that the exploit was poorly engineered.
"This is a pretty crappy exploit in that it doesn't work all that well," wrote Eckelberry on his blog.
Microsoft is currently investigation the flaw. The company will decide whether a security update is released as part of its patch cycle on the second Tuesday of each month or as an out-of-cycle update.
Privilege escalation bug already being exploited in the wild
NASA's Voyager 2 probe set to reveal secrets of space beyond the heliosphere as it goes interstellar
The probe is now more than 18 billion kilometres from Earth, with equipment enabling it to reveal some of the secrets of interstellar space
Four glaciers located west of massive Totten glacier have lost almost three metres of ice in height since 2008
Ceres, located in the asteroid belt, has a carbonaceous-rich upper crust, SwRI study claims