Windows Explorer in Microsoft Windows Vista up to SP1 and Server 2008 allows user-assisted remote attackers to execute arbitrary code via crafted saved-search (.search-ms) files that are not properly handled when saving aka \Windows Saved Search Vulnerability.\