On: Smashing the Stack for Fun and Profit (1996)

[wizzwizz4]

> Unless the attacker is fortunate to find an unprotected function which the compiler missed,

Every instance of the bytes C3, CB, C2 or CA in the executable page could potentially be abused, via carefully-chosen instruction alignment.