Microsoft Works is a suite of productivity tools for home users.
The WkImgSrv.dll ActiveX control included in Microsoft Works allows command execution when a user loads a web page which instantiates the control with an invalid WksPictureInterface property value.
Set the kill bit on class ID 00E1DB59-6EFD-4CE7-8C0A-2DA3BCAAD9C6 as described in Microsoft support article 240797.
Exploit works on Microsoft Works 7 and requires a user to load the exploit page in Internet Explorer.
Internet Explorer on the target machine must treat the script server's host address as in the Local intranet zone or in the Trusted sites zone, and the option Initialize and script ActiveX controls not marked as safe must be set to Enable or Prompt, because the affected ActiveX control is not marked safe for scripting.