Heap Spraying.

An exploitation primitive that fills the heap with many copies of a payload so that a corrupted pointer is highly likely to land on attacker-controlled data. It belongs to the Attacks & Threats category of cybersecurity.

An exploitation primitive that fills the heap with many copies of a payload so that a corrupted pointer is highly likely to land on attacker-controlled data.

Heap spraying populates large regions of process memory with predictable copies of a NOP-sled and shellcode (or, in modern variants, ROP gadgets or fake object vtables). When an attacker triggers a memory corruption bug, such as a use-after-free or type confusion in a browser, the corrupted pointer is steered to a likely address (historically 0x0c0c0c0c) where the spray guarantees the desired bytes. The technique was popularised by Skylined's 2004 Internet Explorer exploit and remains common in browser, document and font-parsing exploits. Modern defences include high-entropy ASLR, partition-isolated heaps (PartitionAlloc, Heap Isolation in Edge), control-flow integrity, and JIT mitigations that prevent attacker JS arrays from leaking into executable memory.

Defences for Heap Spraying typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Heap spray.