Heap Overflow.

A heap overflow writes past the end of a heap-allocated buffer, smashing adjacent chunks or the bookkeeping metadata managed by malloc/free, jemalloc, mimalloc, or other allocators. Unlike stack overflows, there is no return address to hijack directly; instead attackers corrupt data the program will later trust — an adjacent object's function pointer, a C++ vtable pointer, a smart-pointer control block, or allocator free-list links used during free() (the classic "unlink" primitive).

Because heap layout is non-deterministic, exploitation depends on heap grooming / feng shui: performing controlled allocations and frees so a useful target lands immediately after the vulnerable buffer. A canonical real-world case is GHOST (CVE-2015-0235), a heap overflow in glibc's __nss_hostname_digits_dots() reachable through gethostbyname(); Qualys demonstrated full remote code execution against the Exim mail server in 2015, and the flaw had silently existed since glibc 2.2. CVE-2018-4407 showed the same class in Apple's XNU kernel, triggerable remotely by a single crafted TCP packet.

flowchart TD
  A[Allocate victim object + vulnerable buffer adjacently] --> B[Heap grooming positions target after buffer]
  B --> C[Overflow writes past buffer end]
  C --> D{Corrupted target}
  D -->|Allocator metadata| E[free unlink -> arbitrary write]
  D -->|Function pointer / vtable| F[Redirect control flow]
  E --> G[Code execution]
  F --> G

Defences layer allocator hardening (metadata integrity checks, safe unlinking, chunk isolation, guard pages) with ASLR, CFI, sandboxing, and migration to memory-safe languages such as Rust. Heap overflows remain central to browser, kernel, and document-parser exploitation, and feature heavily in Pwn2Own winning chains.