This should make eveyone feel nice and safe. Here you can read a paper about how to exploit a fundamental flaw in the Win32 API to gain full system priviledges
This paper presents a new generation of attacks against Microsoft Windows, and possibly other message-based windowing systems. The flaws presented in this paper are, at the time of writing, unfixable. The only reliable solution to these attacks requires functionality that is not present in Windows, as well as efforts on the part of every single Windows software vendor. Microsoft has known about these flaws for some time; when I alerted them to this attack, their response was that they do not class it as a flaw – the email can be found here.
Scary huh?
