Class 09 · KP 01 / 25

Why the Heap Matters

glibc heap: a dangling pointer to a freed chunk becomes a read/write primitive.

So far we have attacked the stack: return addresses, canaries, ROP. But most real-world native 0-days today live on the heap.
Heap bugs are a huge share of critical vulnerabilities in browsers, kernels, and language runtimes: use-after-free, double-free, and heap overflow dominate.
The stack defenses you learned do not cover the heap:
Stack canaries protect saved return addresses, not heap metadata.
Heap chunks are long-lived and shared, so a single dangling pointer can be reused much later.
The heap is managed by a complex allocator (glibc malloc), and its metadata is stored inline, right next to your data — an attacker's dream.

Key Takeaway

Heap exploitation is where modern memory-corruption research lives. Understanding the allocator is the key to both attack and defense.