All classic mitigations are active – we need a attack (e.g., ROP) rather than a plain buffer overflow.
