McAfee reported on Wednesday that it had been able to reproduce a so-called zero-day bug that affects Yahoo! Messenger, first described by Chinese researchers on Tuesday. The vulnerability is found in Messenger v8.1.0.413. The bug has the potential to allow remote-code execution attacks when an unsuspecting user accepts a webcam invitation.

Yahoo! expects to have a patch for the flaw soon. The bug reported this week takes advantage of a buffer overflow condition, and is different from the vulnerability in YM 8 that was found and patched in June. McAfee recommends blocking outbound Port 5100 traffic until a fix is released. Users should also be cautioned not to accept Webcam invitations from unknown people.