The attached testcase was found by fuzzing DEX files, and results in a heap overflow with a wild memcpy. Note that Kaspersky catch exceptions and continue execution, so running into unmapped pages doesn't terminate the process, this should make exploitation quite realistic.
6751e071bf8dd3497577b29fbf7d097aa98be4740d9f645d2afa24cded401776