A hole in Microsoft Excel has been identified that could allow attackers to take control of a computer, a security group said on Thursday.
The flaw is due to a memory corruption error that occurs when handling or repairing a document containing overly long styles, the French Security Incident Response Team (FrSIRT) said in an advisory.
The flaw, which affects Excel 2000, 2002 and 2003 and Office 2000, XP and 2003, "could be exploited by attackers to execute arbitrary commands by convincing a user to open and repair a specially crafted Excel file," the advisory said.
This is the third vulnerability affecting Excel to surface in less than a month.
A Microsoft representative said the company is investigating reports of a new vulnerability in Excel and was not aware of any attacks related to it.
The representative said in an e-mail: "In order for this attack to be carried out, a user must first open a malicious Excel document that is sent as an e-mail attachment or otherwise provided to them by an attacker. Opening the Excel document out of e-mail will prompt the user to be careful about opening the attachment."
The vulnerability affects only users of Chinese, Japanese or Korean language versions of Excel, the Microsoft representative said.
Customers who believe they are affected can get more information on Microsoft's security Web site.
Excel hackers have been busy. On 16 June, experts warned about a hole that was exploited in at least one targeted cyber attack. About two weeks ago, an Excel hole was discovered that could crash the program after a malicious file is opened.
