Heap-based buffer overflow in the Hrtbeat.ocx (Heartbeat) ActiveX control for Internet Explorer 5.01 through 6 when users who visit online gaming sites that are associated with MSN allows remote attackers to execute arbitrary code via the SetupData parameter.