Invensys Wonderware HMI Reports 3.42.835.0304 and earlier as used in Ocean Data Systems Dream Report before 4.0 and other products allows user-assisted remote attackers to execute arbitrary code via a malformed file that triggers a \write access violation.\