One newsletter I've received says that Microsoft will release an "out of schedule" patch for the IE vulnerability begining at 18:00 GMT on 21 January 2010. I haven't looked yet for confirmation elsewhere, despite this source being a UK publisher, but the patch has been expected.

An update to the Security Bulletin about the vulnerability is also reported to have been released, for those who need, or want, more information about it; but the bulletin probably is not of too much interest to the majority of users.

Anyone getting automatic updates should expect to receive the patch within a fairly short time - assuming the accuracy of the news letter. (Scheduled patches come weekly, so Microsoft apparently can get to all of the few million user machines who get updates within less than a week?)

John