The HxTocCtrl ActiveX control (hxvz.dll) as used in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 in Windows XP SP2 Server 2003 SP1 and SP2 Vista SP1 and Server 2008 allows remote attackers to execute arbitrary code via malformed arguments which triggers memory corruption.