The patch rewrote how shell32.dll parsed metadata and performed bounds checking on file headers. v3 specifically refined this parsing logic, likely closing a bypass discovered after v2 was released. It was a game of whack-a-mole with the black hats.
Microsoft has long removed Windows XP updates from official download channels. However, legitimate archives exist: windowsxp kb917021 v3 x86 enu exe upd