This vulnerability exists because HyperTerminal has an unchecked buffer (a temporary data storage area that has a limited capacity but no specification for the amount of information that can be written into it). If a malicious user sends an e-mail that contains a specifically malformed Web address (URL), it can cause the buffer to overflow, allowing the malicious user to run unauthorized code on the computer.

Note: Although HyperTerminal ships as part of several Microsoft products, it was developed by Hilgraeve, Inc. Additional information about this vulnerability and an update for the full version of HyperTerminal Private Edition are available at http://www.hilgraeve.com.

For more information about this vulnerability, read Microsoft Security Bulletin MS00-079.