Integer underflow in winhlp32.exe in Windows NT Windows 2000 through SP4 Windows XP through SP2 and Windows 2003 allows remote attackers to execute arbitrary code via a malformed .hlp file which leads to a heap-based buffer overflow.