Blair Strang

The issue allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors involving use of the file-open dialog in a child window, related to the `IUnknown QueryService` function in the Windows shlwapi.dll library.

The issue is related to a stack-based buffer overflow in the SetActiveXGUID method within the VersionInfo ActiveX control. This can be exploited by remote attackers to execute arbitrary code by providing a long string in the argument.