At least two sets of exploit code have been posted on the Internet for the security flaws in Yahoo Messenger 8 first One set of code shows how to cause buffer overflow in the Webcam ActiveX component. Another causes a buffer overflow in the viewer ywcvwr.dll. Both exploits were written by Danny.by the security vendor eEye on Tuesday. The two exploits were posted on the Full Disclosure mailing list on Wednesday.
This morning Yahoo released a patch for Yahoo Messenger, however, update is voluntary. Users will be prompted each time the application loads until the update is installed. Given these public exploits all Yahoo Messenger users should update to the latest release as soon as possible.