It's a 1-byte heap buffer overflow when it loads a specially-crafted UTF-16 file with an odd length over 131,076 bytes. The Windows NT heap implementation alrea

It's a 1-byte heap buffer overflow when it loads a specially-crafted UTF-16 file with an odd length over 131,076 bytes. The Windows NT heap implementation already contains a mitigation against overflows of up to 3 bytes (which, as far as I can tell, is 100% effective against 1-byte overflows), so arbitrary code execution is very implausible.