Heap Overflow: Overrunning Into Metadata

• A heap overflow writes past the end of a heap buffer, spilling into the next chunk — and that chunk begins with metadata.
• By overrunning, an attacker can corrupt the adjacent chunk's:
• size field / flags — confuse the allocator about chunk boundaries.
• fd/bk or next pointers (if the next chunk is free) — link-list poisoning.
• Classic techniques built on this: unlink attacks, House of family primitives, and chunk-overlap via a forged size.
• Root cause is the same as stack overflow: a missing bounds check. Only the corrupted structure differs.