A control-flow hijack happens when an attacker causes a program to run instructions in an unintended order or location. Instead of following its normal path, execution is redirected to attacker-chosen code, gadgets, or data that behaves like code.
This matters because control flow is what makes software do trusted work. If an attacker can alter a return address, function pointer, virtual table, callback, or other branch target, they may gain code execution, privilege escalation, or sandbox escape. Control-flow hijacks often follow memory corruption, type confusion, use-after-free bugs, or unsafe deserialization, but they can also appear through logic flaws that let untrusted input influence execution paths. Defenders look for mitigations such as stack canaries, ASLR, control-flow integrity, memory-safe languages, and strict validation of objects passed across trust boundaries. In practice, a control-flow hijack is usually the final stage of a deeper vulnerability, turning a bug into active compromise.