Yahoo Messenger and Trillian instant messaging clients are both subject to critical security vulnerabilities, researchers say.

The Yahoo Messenger bug, which was posted to the Full Disclosure mailing list by Rajesh Sethumadhavan, is a buffer overflow flaw that can be exploited with a specially crafted address book entry.

Messenger immediately crashes when it encounters the malformed entry, Sethumadhavan said, but it may also be susceptible to code execution, meaning an attacker might be able to inject his own malicious code - a keystroke stealer or a spam bot, for instance - into a compromised PC.

Yahoo has not posted a patch for the vulnerability; the company did not immediately respond to a request for confirmation and comment.

Trillian, a multi-service client, also sports two bad bugs, said other researchers.

A trio made up of Nate Mcfeters, Billy "BK" Rios and Raghav "The Pope" Dube identified two vulnerabilities in Trillian's handling of the AIM URI (uniform resource identifier). According to Mcfeters, Rios and Dube, the Trillian flaws are similar to the Internet Explorer/Firefox vulnerability that raised a ruckus last week.

"The first example shows the dangers of passing unfiltered arguments to programs that have registered URIs (much like the firefoxurl: vulnerability)," the three wrote in their advisory. "The second example shows that even if arguments are sanitised [emphasis in original] by the browser, many programs can be remotely pwnd via registered URIs and poor development practices."

US-CERT has posted its own warning as well. The bugs have been confirmed in Trillian 3.1.6.0, added Copenhagen-based vulnerability tracker Secunia, which pegged the problems as "highly critical," its second most dire rating.

The website of Trillian developer Cerulean Studios did not offer an indication that a patch for the Trillian flaw would be forthcoming.