Cdelia Software ImageProcessing allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted BMP file.
http://www.securityfocus.com/archive/1/466786/100/100/threaded
http://www.securityfocus.com/archive/1/466754/100/100/threaded