This is an RCE though...

Yep, and UAF is RCE. DoS must be reliable, like memcpy_s bounds check failure that cleanly aborts the process.

Ah, I misread the first comment and thought it said remote execution, not remote denial