An unauthenticated, network-reachable heap overflow in BIG-IP APM lets attackers achieve remote code execution on any virtual server combining an access policy with an OAuth profile.