It's not entirely clear how the exploit works. Microsoft says it's investigating.