There’s a pretty bad vulnerability out there with the Microsoft Help function. It has been acknowledged by Microsoft; after having been found by a Google employee. This vulnerability ONLY EXISTS for Windows XP and Windows Server 2003; later versions are NOT affected.

This is important because the guy who announced the vulnerability provided explicit documentation on how the vulnerability could be exploited. It involves the “hcp” protocol handler (like the http:// or ftp:// protocol handlers).

It could take Microsoft up to a month to get a patch out for this.

Sources:

Vulnerability in Help Center could allow remote code execution - Microsoft Support
HCO 0-Day Quick Fix - Steve Gibson's Blog