Possible but unlikely. The protocol is relatively simple, and what clients are out there have already been subjected to tons of untrusted input.