It seems like most of the exploits come down to blowing up a parser of one data format or another. Myriad from which to choose, they are written in C for historical reasons, and probably play fast and loose with validation in the name of performance.