Going further: how about a vulnerability in every program compiled with gcc? I'll just leave this here:

http://cm.bell-labs.com/who/ken/trust.html