Microsoft XML Core Services 3.0 4.0 5.0 and 6.0 accesses uninitialized memory locations which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.