Use-After-Free (UAF): The Idea

• A use-after-free happens when a program keeps using a pointer after the chunk it points to has been freed — a dangling pointer.
• After free(p), the memory is returned to a bin and can be handed to the next malloc. But p still points there.
• If the attacker can force a reallocation of that same chunk (a new object of the same size), they now control the bytes the dangling pointer reads or writes.
• Classic exploitation: free an object holding a function pointer or vtable, reallocate it with attacker data, then trigger the stale pointer to redirect control flow.