Microsoft's initial investigation reveals that this vulnerability could allow an attacker to use the speech recognition feature in Windows Vista to verbally execute commands on a user's computer. The attackers' commands are limited to the rights of the logged on user. User Account Control prohibits the attacker from executing any administrative level commands.

This pretty much confirms what I've been saying all along and I had recommended that Vista users do not leave their Speech Recognition feature unattended. However, good security defenses should never rely on user action to prevent exploits. It is my belief that Microsoft should filter out sounds coming from the computer which makes its way back in to the system via Microphone before it gets processed by the Speech Recognition engine as the long term solution. A short term solution is for Microsoft to implement keywords like Apple which allows a user to select a unique word to say to unlock a speech recognition engine. At this point in time, Microsoft will not commit to a patch and are still investigating the issue.