Xcftools could be made to crash or run programs as an administrator if it opened a specially crafted file.