Heap Buffer Overflow

Every running program is allocated memory by the computer, meaning space for its data. Part of this memory the program only requests during runtime, depending on how much it currently needs. This flexible area is called the heap. The program reserves a section there of a fixed size, for example space for 100 characters. A heap buffer overflow occurs when the program writes more into it than it reserved, say 150 characters. The 50 excess characters don’t just disappear; instead, they overwrite whatever lies directly next to them in memory.

From Typo to Security Vulnerability

In the most harmless case, the program simply crashes. It becomes dangerous because management information often sits right next to the data in memory. This might indicate, for example, how large the next memory block is or which function should be called next. Anyone who deliberately overwrites these values can redirect the program’s execution flow.

This is exactly what attackers aim for. They send a program an overly long input, such as a manipulated image or a specially crafted webpage. If the program doesn’t check the length, it ends up executing foreign code. This is called Remote Code Execution, meaning the execution of commands from a distance. Such vulnerabilities are among the most severe of all, because often no click from the user is required.

That’s why heap overflows regularly appear in security advisories. They are assigned a CVE number, a globally unique identifier for a known vulnerability. Companies pay high bounties for such findings, often in the five-figure range.

Why the Boundary Isn’t Enforced Automatically

Whether an overflow is even possible depends on the programming language. Languages like C and C++ do not check, when writing, whether you’re still within the reserved area. This was a deliberate decision: the check costs computing time, and when these languages were developed, speed was more important. The programmer bears the responsibility for controlling the length themselves.

A typical mistake looks like this: A program reserves space based on a number stated in the file being read. This number claims the image is 100 pixels wide. Afterward, the program copies the actual image data, which is actually 500 pixels wide. Nobody checked whether the two values matched.

For clarification: in the related stack buffer overflow, an area belonging to a currently running function overflows. The stack is strictly ordered, whereas the heap is not. What lies next to a block in the heap depends on what the program previously requested and released. Attacks on the heap are therefore more elaborate, but by no means impossible.

Chrome Updates, Rust, and AI Libraries

When your browser reports an urgent security update, it’s often exactly this kind of error behind it. Google Chrome releases several patches against heap overflows every year, usually in the component that renders images or videos. Smartphones, routers, and automotive systems are also affected, because a lot of software there is written in C.

In the AI world, this topic is current because many libraries for processing models are written in C++. Anyone who loads a foreign model from the internet is thereby also loading a file that gets read by such code. Overflows have repeatedly been found precisely in these loading functions.

As a countermeasure, companies are increasingly turning to the language Rust, which automatically checks every access against its bounds. Microsoft and Google report that around 70 percent of their severe security vulnerabilities stem from memory errors of this kind. A common misconception is that a crash is harmless. In security research, a reproducible crash is considered a starting point for a potential attack.