Possibly through a ROP chain. Abusing VLC's code itself. You don't need memory that's writeable and executable for that. Check the Wikipedia link in my comment about ROP exploits.
It turns out that a lot of programs can be tricked into interpreting a family of languages called rop chains.