There might be a buffer exploit of some kind that one could use in the player to trick it into uploading and running arbitrary code

haha... i can see the headlines now.

EMPEG owners being DOSed by a worm that exploits a buffer overflow in the player software, reverting it version to 1.03.