A critical flaw in the way that the AOL’s instant messaging client displays Web-based graphics could be exploited by criminals to create a self-copying worm attack, security researchers are warning.

The flaw was discovered by researchers at Core Security Technologies, which has been working with AOL over the past few weeks to patch the problem. AOL’s servers are now filtering instant messaging traffic to intercept any attacks, but the company has yet to patch the underlying problem in its client software.