What is a "good" memory corruption vulnerability?
Summary: Project Zero's Chris Evans published a four-part 2015 series ranking memory corruption bug classes by how reliably they can be exploited, defining a "100% reliable" exploit as one guaranteed to succeed against a specific version and environment through deterministic steps, with failures detectable as clean aborts rather than crashes. He identifies intra-chunk heap overflows and relative writes as the strongest candidates because the corruption never crosses a heap chunk, while inter-chunk heap overflows usually retain a probabilistic element despite heap grooming, and use-after-free bugs face threading, heap corner-case, and object-size sensitivity challenges.
Why it matters: The post states that type confusion bugs can be quite nasty and that Project Zero is investigating compiler-based mitigations for them, which tells you where defensive tooling is still thin. It also notes that a crash is the worst outcome for an attacker because it is a noisy signal that may lead to detection, so the bugs that abort cleanly are the ones your monitoring will never see.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026