If you are unlucky, it's going to execute whatever user data a malicious attacker added by carefully crafted input. (Yes, these days that's harder, but you can

If you are unlucky, it's going to execute whatever user data a malicious attacker added by carefully crafted input. (Yes, these days that's harder, but you can still do a more complicated version of the same attacks. See return oriented programming.)