Why go through the trouble of exploring such a bug, when you have the ability to just replace the binary with something with a backdoor?