Plug-ins, like this ActiveX control, are one of the top targets of malicious web exploit toolkit developers.  These web exploit toolkits now account for nearly all browser-related exploits seen in the wild.  The exploitation of this ActiveX control provides the attacker with the privileges of the end user, which could allow complete control over the targeted endpoint.

Although this ActiveX control is not installed by default, most PCs have it.  Nearly all Visual Basic applications include this DLL during the installation process, and, since it's considered a shared component of these applications, it is typically left on the system even after an uninstall.  So, if a Visual Basic program has ever been installed on a computer, it probably has this ActiveX control installed, too, which makes this component highly prevalent, and, therefore, a lucrative target for attackers.

The Microsoft ATL is a collection of C++ template code that enables rapid development of programs through the use of prebuilt code.  MSCOMM32 uses a custom version of the ATL which is remotely exploitable. Although part of the Visual Basic 6 runtime and not a default component of the Windows OS, the MSCOMM32 ActiveX control is ubiquitous. The vulnerability regards loading persisted data through the ATL abstraction layer into COM controls this library exports; the result is that a heap overflow may occur. X-Force has confirmed that reliable remote code execution is possible.

Patches are available for this issue. See References for details.