The Hyperlink Object Library for Windows 98 2000 XP and Server 2003 allows remote attackers to execute arbitrary code via a crafted link that triggers an \unchecked buffer\ in the library possibly due to a buffer overflow.