To exploit this vulnerability, an unauthenticated, remote attacker must convince the user to view a malicious QuickTime movie file. An attacker could accomplish this through social engineering and hosting the movie on a malicious website or by delivering the file directly to the user via e-mail, a FTP server, or a peer-to-peer network.
Successful exploitation allows the attacker to execute arbitrary code with the permissions of the user. Users on Microsoft Windows systems typically hold elevated privileges, potentially allowing the attacker to gain control of the affected system.
During installation, QuickTime is registered as the default application for most media types on a system, including .mov files. This increases the
likelihood that the application may be used to open a malicious file. It is also often possible to embed QuickTime within a web page and force it to be used as the player for an arbitrary movie file.