Buffer overflow in Internet Explorer 5 allows remote attackers to execute commands via a malformed Favorites icon.