A heap-buffer-overflow happens when a program writes past the end of a buffer allocated on the heap, the part of memory used for dynamic data. Because the write lands outside the intended region, it can corrupt adjacent memory, crash the process, or alter program state in unexpected ways.
In cyber security, this bug matters because attackers can sometimes trigger it with crafted input, especially in parsers and decoders that process untrusted files. Image libraries, document readers, and media pipelines are common targets because they handle complex formats and large amounts of attacker-controlled data. When the overflow occurs during server-side processing, it may be used for denial of service or, in some environments, as part of a code execution chain.
Defenders look for this class of bug through fuzzing, code review, bounds checks, and memory-safe programming practices. Patching the vulnerable library and limiting which file types are decoded on the server are practical ways to reduce exposure.