The Preloader ActiveX control used by Internet Explorer allows remote attackers to read arbitrary files.