In https://support.apple.com/en-us/HT207617 Apple admits that this may lead to arbitrary code execution.