A wild stab in the dark: remote code execution using a standard codec/library, easily triggered in the context of an ad.