Buffer overflow in the HTML Converter (HTML32.cnv) on various Windows operating systems allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via cut-and-paste operation as demonstrated in Internet Explorer 5.0 using a long \align\ argument in an HR tag.