Article's very vague about how the RCE actually works. They talk about the memory corruption bugs but not how exactly those become RCE.