Unrealistic? There was recent significant bug in font definition parsing: and libjpeg changenotes are stuffed with protection advisories.
dll, will allow remote attackers to execute arbitrary code by way of a JPEG https://bookmarks-hit.com/story18304605/5-easy-facts-about-jpg-exploit-new-described