Plug-ins, like this ActiveX control, are the top targets of malicious web exploit toolkit developers.  These web exploit toolkits now account for nearly all browser-related exploits seen in the wild.  The exploitation of this ActiveX control provides the attacker with the privileges of the end user, which could allow complete control over the targeted endpoint.

Although this ActiveX control is not installed by default, attackers have been known to push down ActiveX controls, especially those that are digitally signed by Microsoft, in an attempt to have the vulnerable component installed on the endpoint so that it could be exploited.  Attackers exploiting the Microsoft Access Snapshot Viewer vulnerability, which was also not installed by default on the Windows operating system, have successfully used this technique.  Although the users are required to install the control, it is signed by Microsoft, which lends credibility to the installation.  The Snapshot vulnerability was announced in July, and we are still seeing active exploitation of it.

The Microsoft Windows Media Encoder wmex.dll ActiveX control is vulnerable to a buffer overflow. The wmex.dll ActiveX control was incorrectly marked as Safe for Scripting (SFS) in Internet Explorer. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to overflow a buffer and execute arbitrary code on the system with the privileges of the victim or cause the victim's browser to crash.

Patches are available for this issue. See References for details.