CVE-2011-0611
Size inconsistency allows code execution, first discovered when it was actively exploited in-the-wild.
CVE-2010-0258
Improperly-parsed file containing records of different types leads to code execution when a memory location is interpreted as a different object than intended.