Generally speaking it is much more complicated to exploit these bugs than they used to be, but often attackers find ways such return to libc, return-oriented programming (which ASLR and other technology is designed to combat) or things like heap spraying.