Older versions of MusicMatch (like a large number of other software packages, including core components of Windows) make an insecure call to CreateProcess. This is a local attack which requires that an attack can write files to the root of the C: drive, something that actually is possible with versions of Winows prior to XP.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/37222/musicmatch_CreateProcess.txt
Source: https://packetstormsecurity.com/files/37222/musicmatch_CreateProcess.txt.html