A similar quirk of the registry API is that it has a simplified set of methods that don't specify the data type of the value, so you can have an application tha

A similar quirk of the registry API is that it has a simplified set of methods that don't specify the data type of the value, so you can have an application that expects to read a null terminated string value, but substitute a binary value with no null termination. If the app doesn't handle that right, it's buffer overrun time. Usually that's foot-shooting, but sometimes you can do that in HKCU as a low privileged user to a value that gets read by a higher privileged process and causes it to "misbehave".