Researchers attending RSA Conference 2007 yesterday announced a new vulnerability — with a working exploit — that they said demonstrates Microsoft's Windows Vista's weakest link: its third-party software.