Bugs show up everywhere:
https://marc.info/?l=openbsd-ports&m=150824457105590&w=2
This is a full disclosure of a 4 byte stack overwrite in GNU ghostscript 9.07.
Though perhaps I should have sat on it for 4 months, and registered a domain first? How does ghostsmash.com sound?