Windows VCF File / Mailto Link Denial of Service
Windows VCF cards do not properly sanitize email addresses allowing for HTML injection.
A corrupt VCF card can cause all the users currently opened files and applications to be closed
and their session to be terminated without requiring any accompanying attacker supplied code.
This can be done by crafting the Mailto link to point to Windows "logoff.exe". The corrupt VCF card can then kill all users applications and also log the target off their computer, if the VCF card is opened in using Windows Contacts and the link is clicked.
Full advisory:
http://hyp3rlinx.altervista.org/advis...
Note: If video blurry change quality settings to HD.