I didn't think it was possible but apparently it is. Here's the news release:

------------------
Microsoft has issued a patch for a new, critical flaw in Windows that could allow an attacker to take control of a victim's computer or run malicious programs on it, the company said.

If exploited, the flaw could allow an attacker to delete files, search records, send e-mails or even launch a new attack from the victim's computer.

The problem involves how a technology in DirectX -- a group of instructions used by Windows programs to play audio and video -- handles MIDI (musical instrument digital interface) files. An attacker could write a MIDI file designed to exploit the flaw and send it in an e-mail or host it on a Web site or shared network, said Stephen Toulouse, security program manager at Microsoft's Security Response Center.
-----------------

Here's the link to Microsoft's info page and patch release:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms03-030.asp

[This message has been edited by The Pro (edited 07-28-2003).]