Yep, and UAF is RCE. DoS must be reliable, like memcpy_s bounds check failure that cleanly aborts the process.