Cybersecurity glossary
What is a Heap Overflow?
Learn what a heap overflow is, how overflowing dynamically allocated buffers corrupts neighboring objects or allocator metadata, how attackers abuse heap layouts, and how to prevent heap overflows.
Definition
A heap overflow is a buffer overflow in dynamically allocated (heap) memory where a write exceeds an allocated block’s size, corrupting adjacent heap objects, allocator metadata, or application data structures and potentially enabling arbitrary writes or code execution.
Why heap overflows matter
Dynamic allocation is how parsers grow with input size—and how attackers influence layout. When a write exceeds a heap chunk, the next object’s fields or the allocator’s internal pointers can change under the program’s feet.
Heap Overflow bugs power many browser, kernel, and library exploits because heap objects often contain function pointers, lengths, and references that become reliable corruption primitives once adjacent memory is attacker-controlled.
How a heap overflow becomes useful
Allocate a heap buffer
Code mallocs or news a block sized from a protocol field or computed length.
Miscalculate capacity
Integer wrap, missing checks, or trusting a length field yields a too-small allocation.
Copy past the chunk
A loop or memcpy writes beyond the allocated size into neighboring memory.
Corrupt objects or metadata
Adjacent object fields, vtables, or allocator headers take attacker values.
Trigger a powerful primitive
Later frees, virtual calls, or pointer dereferences turn corruption into control.
Common heap overflow shapes
Length-field lies
A file says “payload is 16 bytes” but the parser allocates 16 and copies 160.
Size math wrap
width * height * bpp wraps to a tiny allocation; the full decode still runs.
Off-by-one / off-by-few
A single extra byte overwrites a critical flag or least-significant pointer byte.
Neighbor object smash
Even without metadata attacks, overwriting the next C++ object can be enough.
Hardening and prevention
| Control | Notes |
|---|---|
| Checked size math | Use saturating or checked multiplication before allocation; reject absurd sizes |
| Bounds before copy | Compare claimed length to remaining input and allocated capacity |
| Hardened allocators | Enable modern malloc checks, guard pages, and quarantine where available |
| Isolation | Sandbox codecs and parsers so heap corruption cannot escape the worker |
| Safe languages | Prefer Rust/Go/managed runtimes for new untrusted parsers |
| Continuous fuzzing | Heap overflows often surface as ASan crashes under fuzzing |
- Audit every allocate-then-copy path that uses attacker-influenced lengths.
- Add overflow-safe arithmetic helpers for size calculations.
- Build with AddressSanitizer in CI for native components.
- Enable allocator hardening flags in production where supported.
- Fuzz image, font, document, and protocol parsers that heap-allocate.
- Sandbox high-risk native decode pipelines.
- Prefer memory-safe rewrites for repeatedly buggy heap parsers.
- Triage ASan heap-buffer-overflow reports as security bugs by default.
The practical takeaway
A heap overflow writes past a dynamically allocated buffer and corrupts neighboring heap state—often a stepping stone to arbitrary writes or code execution. Validate sizes before you allocate and copy; do not trust length fields from the wire.
If ASan reports a heap-buffer-overflow on public input, treat it as an exploitability investigation, not a cosmetic crash.
Related security terms
Buffer Overflow
General class of writes that exceed a buffer’s capacity.
Stack Buffer Overflow
Overflow targeting stack frames rather than heap allocations.
Use-After-Free
Another heap-centric bug class involving reuse of freed memory.
Out-of-Bounds Write
Writes outside valid object bounds, including heap overflows.
Frequently asked questions
What is a heap overflow in simple terms?
The program allocates a chunk of memory on the heap, then writes more data into it than was allocated. Extra bytes spill into the next object or into the allocator’s bookkeeping.
How does a heap overflow differ from a stack overflow?
Stack overflows corrupt call frames and often return addresses. Heap overflows corrupt other heap objects or allocator metadata. Exploitation usually targets pointers, vtables, or free-list structures instead of a single return address.
What is heap metadata corruption?
Many allocators store size and linkage fields near user chunks. Overflowing into those fields can distort free lists and produce powerful write primitives when chunks are freed or coalesced.
Are modern allocators immune?
Hardened allocators add checks and randomness that raise cost, but application-level overflows into neighboring objects remain dangerous even when metadata is protected.
Which code patterns cause heap overflows?
Incorrect length fields in binary formats, integer overflows in allocation size math, off-by-one loops, and unbounded copies into malloc’d buffers.
How do you prevent heap overflows?
Validate sizes before allocate-and-copy, use safe APIs, enable allocator hardening, fuzz parsers, and prefer memory-safe languages for untrusted input handling.
Is a heap overflow always remote code execution?
No. Impact ranges from crash to reliable arbitrary write. Treat reachable heap overflows as high severity until proven otherwise.
References
Explore authoritative guidance and frameworks related to heap overflow.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.