Comments by "Cees Timmerman" (@CTimmerman) on "" video.

So instead of making the stack pointer only writable to control statements, you mark data as not executable, so when due to lack of bounds checking the stack pointer is overwritten, it's not executable, which it wasn't in the first place, so execution resumes with your data, which can't be executed due to DEP, so use the executable heap memory instead of the stack and poorly-written code to overwrite the heap pointer with a known function and your choice of parameter such as a path to an executable into a popen.
1