It is the kind of thing I would normally associate with client based applications software being served with a specially crafted/malformed item.

The standard MS comment goes something like: "An attacker that successfully exploited this vulnerability would be able to execute arbitrary code with the privileges of the current user."
So you truely are confusing this with buffer overflows? Seriously?!