OpenSSL team noted, remote code execution may still be possible on some platforms, especially downstream ones where platform and compiler combinations may not be set right, so the buffers on the stack could still be vulnerable.