Heap-based buffer overflow in Lhaplus.exe in Lhaplus 1.52 and possibly earlier versions allows remote attackers to execute arbitrary code via an LZH archive with a long header as specified by the extendedHeaderSize.