Hi All, I have found a bug in the function TCS_W_UCS_4::marshalWString of cs-UCS-4.cc. The loop marshaling the wstring is iterating one more than it should causing a buffer overrun. i.e. for (_CORBA_ULong i=0; i<=len; i++) ... should be for (_CORBA_ULong i=0; i<len; i++) ... Thanks, Brett Zimmerman Ripple Systems Pty Ltd