AOL Instant Messenger had several remote code execution exploits. They worked just by sending an IM to someone. You could also crash their computer remotely, or maybe it would just create their client.

Also their stored password encryption algorithm was easily reversible.

AIM's built-in HTML parser had a bunch of super-linear parser complexity bugs, leading to people building "punters".

The AIM days are one for the books. What a time to be alive and interested in computerin'

Wasn’t that how audio avatars worked (not by crashing, but ACr)? What a time to be alive.