No one's published an example which causes arbitrary code execution yet (that I'm aware of), but most bugs of this type end up there eventually.

You'd need an infoleak but from somewhere, but I doubt anyone who has one will come forward.

I guess the problem is that you don't know:

> allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact

As far as I understand, trying to predict what is possible by exploiting a buffer overflow is hard because it depends on many specifics, such as compiler options used, OS protections, ...

No. Buffer overflows can be used for privilege escalation.

Crashes are better than privilege escalation, but they do not mean that privilege escalation is impossible.