The RichEdit component in Microsoft Windows 2000 SP4 XP SP2 and 2003 SP1; Office 2000 SP3 XP SP3 2003 SP2 and Office 2004 for Mac; and Learning Essentials for Microsoft Office 1.0 1.1 and 1.5 allows user-assisted remote attackers to execute arbitrary code via a malformed OLE object in an RTF file which triggers memory corruption.