> The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements by adding specially crafted content that could exploit this vulnerability.

So ad networks are a delivery vector.

Interestingly, both ESC and EMET could help mitigate this, so I wonder if it's a JavaScript or similar exploit.