Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code by overwriting a function pointer.