Comment by vardump

Possibly through a ROP chain. Abusing VLC's code itself. You don't need memory that's writeable and executable for that. Check the Wikipedia link in my comment about ROP exploits.