Basically, if you have any potential memory attacks in your software (buffer overflows, bad printf format strings, stack smashes, etc), an attacker can make you

Basically, if you have any potential memory attacks in your software (buffer overflows, bad printf format strings, stack smashes, etc), an attacker can make your software do whatever he wants. He can do this without using a RET instruction (which is the more "standard" way of doing this, so people have been investigating looking for it as an active defense).