So much for the improved security in IE7. This un-patched flaw affects both IE6 & IE7, and there's already an exploit floating around.

"Once the exploit is embedded in the system it will load further malicious software, according to McAfee's description. To date, this exploit has not been widely distributed, but more virus makers are likely to examine the hole and generate new exploits which take advantage of it."