SPAN, The Heap, and esoteric memory buggery…

Summary: Cisco Talos analyzed an Internet Explorer 0-day heap corruption bug that lets an attacker overwrite an object pointer with four arbitrary bytes, which then leads to a function pointer being called. The write-up describes using JavaScript heap-spray to fill memory with repeated NOP bytes such as 0x0a0a0a0a, overwriting the object pointer with that value so execution slides through the NOPs into shellcode.
Bottom line: A four-byte overwrite in a multi-threaded browser was enough to turn a heap corruption bug into reliable code execution, using nothing more than JavaScript string allocations to shape memory. That is the class of bug that turns a browsing session into an attacker's foothold.

Read the original at Cisco Talos ↗

Topics: Malware
Related: ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026
Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026
Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026