Microsoft Security Advisory (960906)

What:
Microsoft WordPad is a simple text editor supplied with most versions of Microsoft Windows. WordPad Text Converters are components installed by default that allow some applications to open Word documents if Word isn't installed.

WordPad is prone to a remote code-execution vulnerability because of an unspecified error that may result in corrupted memory. This issue can be triggered when WordPad is used to open specially crafted '.doc', '.wri', or '.rtf' files.

An attacker could exploit this issue to execute arbitrary code with the privileges of the currently logged-in user. Failed exploit attempts may result in denial-of-service conditions.

How:
1. An attacker constructs a malicious document sufficient to trigger this issue. The file may
consist of arbitrary code, replacement memory addresses, and possibly NOP instructions.

2. The attacker uses email or other means to distribute the file and entices an unsuspecting
victim to open it.

3. When the victim opens the file, arbitrary code will run. Successfully exploiting this issue can
result in the remote compromise of affected computers. Failed exploit attempts may crash
the application.

Prevention:
Microsoft has identified the following workaround for this issue; Disable the WordPad Text Converter for the Word 97 file format. Please see the referenced advisory for more information regarding this workaround.

Read more here