-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hello kcope,
the vulnerability that you've found isn't an Unicode-based buffer
overflow, Spreadsheet-Perl just converts the string to Unicode and you
can edit it later with a hex editor.
It's just a simple stack overflow that overwrites the memory after the
return address. Until all the write-able stack memory is full and the
application tries to overwrite the read-only memory after it, an
exception happens. So you won't be able to exploit it by using the
return address of the vulnerable 'hlink' function but you can still use
the SE handler for exploitation.
It looks like Microsoft should release security patches ASAP.
Sincerely yours,
Manuel Santamarina Suarez