A certain ActiveX control in Adobe Acrobat 9 when used with Microsoft Windows Vista and Internet Explorer 7 allows remote attackers to cause a denial of service (browser crash) via an src property value with an invalid acroie:// URL.