Microsoft rarely deploys a patch "out of cycle," meaning outside its usual second Tuesday of every month schedule. The last such update was shipped in December 2011, and was the first for that year.

Also affected is software written by third-party developers who have bundled the buggy ActiveX control with their code or called it. Those developers will have to provide their own updates to customers.

"Any developer that has released an ActiveX control should review the information for this security bulletin," said Jason Miller, manager of research and development at VMware. "These developers may need to release updates to their own software to ensure they are not using a vulnerable file in their ActiveX control."

Attackers can also exploit this bug using "drive-by download" attacks that automatically trigger the vulnerability when IE users browse to a malicious site, Microsoft admitted.

That means the flaw patched by MS12-027 is a double threat. "There are two attack scenarios. There's the malicious website [scenario] and then RTF documents, which are pretty common," Miller said.