Heap overflow on HTML help (.chm) files structure parsing.
vulners.com/securityvulns/securityvulns:doc:8852
vulners.com/securityvulns/securityvulns:doc:8853
vulners.com/securityvulns/securityvulns:doc:8857