# Exploiting Glibc Heap Vulnerabilities

Methodology for exploiting glibc ptmalloc2 heap vulnerabilities during authorized...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill exploiting-glibc-heap-vulnerabilities -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill exploiting-glibc-heap-vulnerabilities -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill exploiting-glibc-heap-vulnerabilities -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill exploiting-glibc-heap-vulnerabilities -g -a gemini-cli -y`

## Description

Methodology for exploiting glibc ptmalloc2 heap vulnerabilities during authorized engagements, use-after-free, double-free, heap overflow, and bin-based attacks (tcache poisoning, fast-bin dup, unsorted/large-bin), including modern mitigations (tcache key, safe-linking, hook removal) and how to obtain leaks and arbitrary read/write.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Exploiting glibc Heap Vulnerabilities

## When to Use

- During authorized exploitation of programs that dynamically manage memory with `malloc`/`calloc`/`free` and contain
  use-after-free, double-free, heap overflow, or off-by-one (poison-null-byte) bugs.
- When the stack is not the corruption surface but you control freed-chunk contents, chunk size fields, or allocation
  ordering, and want to convert that into an arbitrary read/write or code-pointer overwrite.
- When selecting a bin-specific primitive: tcache poisoning, fast-bin dup, unsorted-bin attack, large-bin attack, House
  of Force/Einherjar/Botcake, etc.
- When you must account for the target glibc version's mitigations (tcache `key`, safe-linking, removed malloc hooks).

## Critical: Concepts/Steps Most Often Missed

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/binary-exploitation/exploiting-glibc-heap-vulnerabilities/SKILL.md