A patch has been released for Yahoo! Messenger which fixes a serious flaw that lets an attacker control a user’s computer remotely.

The flaw is connected on how the messenger processes a control on ActiveX. The type of flaw according to The Register’s article is a buffer overflow flaw.

In order for the attack to succeed, a user must somehow visit a site which contains a malicious html code. The activities that attackers can do with this exploit are:
1. Execute a malicious code.
2. Crash IE or another program in the user’s computer.
3. Logout of the current session.

Yahoo! itself may be the reason on how the flaw has been exploited.

Source: The Register