Comment Re:Ah, preview! (Score 3, Interesting) 49
It doesn't "run code". It doesn't need to.
It's not a new issue, just a new instance of it. If you have a file that contains external resources, such as HTML, to preview it you need to load the external resources. Which isn't a vulnerability in itself, but allows you to initiate a new network access request without user action. And Windows will helpfully attempt to log in to the random external server with the username and password of the current local user, which is the real vulnerability.
And the password is hashed, but that provides no real security - the hash effectively is the password and is sent in plain text on the wire.