I guess the problem is that you don't know: > allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact

I guess the problem is that you don't know: > allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact As far as I understand, trying to predict what is possible by exploiting a buffer overflow is hard because it depends on many specifics, such as compiler options used, OS protections, ...