Queue.dll for the message queuing service (LQserver.exe) in CA BrightStor ARCServe BackUp v9.01 through R11.5 and Enterprise Backup r10.5 allows remote attackers to execute arbitrary code via a malformed ONRPC protocol request for operation 0x76 which causes ARCserve Backup to dereference arbitrary pointers.