CyberGlossary

Vulnerabilities

Heap Overflow

Also known as: Heap buffer overflow

Definition

A buffer overflow that occurs in dynamically allocated memory, often corrupting allocator metadata, function pointers, or object virtual tables.

A heap overflow writes past the end of a heap-allocated buffer, smashing adjacent chunks or allocator metadata managed by malloc/free, jemalloc, mimalloc, or other allocators. Because heap layouts are non-deterministic, exploitation typically involves heap-grooming or feng-shui to position useful targets next to the vulnerable buffer — function pointers, vtables, smart-pointer control blocks, or critical state. Modern allocators harden metadata, isolate chunks, and add guard pages, while ASLR, CFI, sandboxing, and memory-safe languages reduce impact. Heap overflows are central to browser, kernel, and document-parser exploitation, including many Pwn2Own winning entries.

Examples

  • CVE-2018-4407 — XNU kernel TCP heap overflow.
  • Numerous Chrome JavaScript engine heap overflows exploited at Pwn2Own.

Related terms