Heap exploitation is metadata corruption, not data corruption. The stack gives you a return address. The heap gives you glibc's allocator, whose freelist pointers live inside the chunks you control. Overwrite a freed chunk's fd pointer and malloc hands you an arbitrary address. Version is everything: tcache (2.26), key check (2.29), safe-linking (2.32), hooks removed (2.34). Same bug, different difficulty on each. https://www.kayssel.com/newsletter/issue-66/ #InfoSec #CyberSecurity #Pentesting #pwn #OffSec #glibc