Microsoft said a security vulnerability in its Office software, which might allow an attacker to take control of a victim's machine, could only be exploited under the most "bizarre" conditions.
In an advisory, veteran Bulgarian bug hunter Georgi Guninski said he had found a vulnerability that may cause arbitrary programs to be executed by double clicking on a Microsoft Office document from Windows Explorer, or by launching a document from the Start/Run menu.
The exploitation works in conjunction with particular dynamic link library (DLL) files that could, according to Guninski, be linked to malicious code.
In an alert posted to security website BugTraq, Guninski said: "If certain DLLs are present in the current directory and the user double clicks on a Microsoft Office document or launches the document from Start/Run, then the DLLs are executed. This allows [for the] executing [of] native code and may take full control over [a] user's computer."
Guninski singled out riched20.dll and msi.dll as two particularly vulnerable DLL files, although he said other files could be affected. Other reports on Bugtraq said that the problem is more general and is related to how Microsoft's operating system loads DLLs.
Scott Culp, a program manager with Microsoft's Security Response Center, played down the problem and said the exploitation involves tricking a user into running an 'untrusted' DLL file in the same directory as a Microsoft Office document. This would be very difficult to achieve, he said.
Neil Laver, Windows 2000 product marketing manager at Microsoft, said: "The circumstances in which this is a security issue are so bizarre that it is hardly an issue. In reality, it is so difficult to exploit it is not a real issue."
Other security experts said the importance of the vulnerability was that it might be used in combination with other attacks, particularly if a cracker had already gained access to a system.
"While it doesn't appear to be a high risk on its own, it could well become dangerous given the right circumstances," said Roy Hills, testing development director at security company NTA Monitor.
Hills said that the problem raised questions about what other "undocumented features" of Office applications could be maliciously exploited.
"Looking at this specific issue, it looks like a classic two-stage attack where the code is first installed on the target system somehow, and then an unrelated action causes it to be executed," he added.
PUBG news and updates: PUBG says 'Sorry for the server issues' with free item and 20,000 battle points
But only if you power up the game before close-of-play on Tuesday
Another shape could have indicated hard-to-detect particles
Latest SOFIA data indicates that magnetic fields may be responsible
A mere two billion years after the Big Bang