Others concurred. Symantec's alert to customers of its DeepSight threat network, for instance, rated MS07-010 as a "10" out of a possible 10 on its urgency scale. And Minoo Hamilton, senior security researcher with patch management vendor nCircle, said the patch was not only a critical fix, but an embarrassment to Microsoft.

"There have been so many vulnerabilities having to do with parsing files," said Hamilton, "that this is exactly the kind of thing that you would have expected Microsoft to catch. They'll have to put more effort into securing their security software because this is embarrassing."

Lamar Bailey, the senior X-Force operations officer at IBM's Internet Security Systems (ISS), disagreed with Sarwate's, Hamilton's, and Symantec's prognosis. "These products automatically update, so the exposure will be short," said Bailey. "I wouldn't be surprised if they hadn't already updated themselves."

Instead of the malware bug, Bailey tagged MS07-016, the bulletin that patched three flaws in Internet Explorer (IE), as the one ISS feels should be deployed right away. The reason: a vulnerability in how IE processes requests from FTP (File Transfer Protocol) servers.

"Lots of shareware sites actually use links to an FTP server," said Bailey. "Users don't always know that they're even connecting to an FTP server." Attackers could entice users to malicious Web sites hosting innocent-looking files for downloading, while they're actually exploiting the IE bug to hijack the PC.