This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Yahoo Messenger. User interaction is required to exploit this vulnerability in that the target must visit a malicious page.
The specific flaw exists within the ActiveX control Yahoo.AudioConf:
When large values are specified for the 'socksHostname' and 'hostname' properties, and the createAndJoinConference() method is called, a stack overflow occurs. Exploitation can result in code execution under the context of the current user.