Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally.