As opposed to, say, running a code (already existing in client software) for rendering transparent surfaces (by sending client a level that features such surfac

As opposed to, say, running a code (already existing in client software) for rendering transparent surfaces (by sending client a level that features such surfaces) Also I think sometimes there are vulnerabilities where you can technically run some tiny bit of your code on a vulnerable machine, but it would lead to a crash. Hence, people use "arbitrary code execution" to distinguish this particular threat from the less severe ones.