In the current case, please note the parsers of such programs tend to be designed to be insecure, so it’s easy to google for examples that crash the program. In some cases, like python, projects maintainers even refuse to fix such bugs because the way it happens is considered to be the normal behaviour.
So the wrong security decision that can be done is to let them work on untrusted code rather than founding more thing that can crash them. So this can’t even be used for denial of service
There are people who think even the 2014 post is still a valid question that doesn't ask for something that can be malicious.
Don’t vote to close as a duplicate. Both parties refer to What qualifies as malicious code? to explain whether it’s allowed or not. Please read that comment !
As that question isn’t part of what is asked on What qualifies as malicious code?, there’s no reason it can get asnwered on What qualifies as malicious code?.