WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 accesses out-of-bounds memory during processing of HTML tables which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document.