Another possibility for remote code execution would be to trigger a
context-switch mid-memcpy which would halt the memory copy operation
before it hits an unpaged address. This, if possible, might leave the
heap in a corrupted state but allow another thread to access/traverse
the heap before the exception occurs. However, Microsoft compilers
optimize the memcpy() function call to the REPNE MOVSD instruction. This
makes it extremely unlikely, if not statistically impossible, to
get a context switch at the right time before an unpaged address is
accessed. Once again, this cannot be used to exploit this bug.