I guess the problem is that you don't know:

> allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact

As far as I understand, trying to predict what is possible by exploiting a buffer overflow is hard because it depends on many specifics, such as compiler options used, OS protections, ...