New Internet Explorer 8 0-day

The specific flaw exists within the handling of CMarkup objects. The allocation initially happens within CMarkup::CreateInitialMarkup.   Nothing in the wild yet.