It depends when systemd-resolved is involved but let's imagine the following case:
I send you an email with a picture inside: http://myevilandswagsite.com/picture.png. Your local mail reader (Outlook, Thunderbird, etc.) will probably load the remote picture. To get the picture, it has to get the IP address of myevilandswagsite.com, so it will send DNS request to my evil DNS. My evil DNS will respond with a specially crafted response which exploit the buffer overflow.
So, the attacker can be "remote" without any restriction. Everytime I can drive you to resolve my DNS hostname, I can pown you. We can imagine that Google could take the full control of many machines by sending malicious answer to DNS queries everytime someone try to reach www.google.com
EDIT: I think to another old widespread attack. Because DNS requests are in UDP, you can try to emit many many DNS answers with the IP source of your choice (whatever, this is UDP). If your answer come before the real good one and is accepted by the host who make the request, it will use it.
So why not trying to send DNS response for www.google.com int he name of the real Google DNS and pray for they are accepted. In order to make them accepted, you need to guess the good UDP ID sequence and the good DNS query ID. If I correctly remember this is 65535*65535 possibilities but "hey, still better than lotery"