Buffer overflow in the CreateDIBPalette function in win32k.sys in Microsoft Windows XP SP3 Server 2003 R2 Enterprise SP2 Vista Business SP1 Windows 7 and Server 2008 SP2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code by performing a clipboard operation (GetClipboardData API function) with a crafted bitmap with a palette that contains a large number of colors.