Heap corruption is damage to dynamically allocated memory on the heap, the area programs use for data whose size is not fixed in advance. It usually happens when code writes past an allocation, uses a freed pointer, or trusts a bad length field and copies too much data. In C and C++, the runtime does not automatically stop these mistakes, so a small parsing error can destabilize the whole process.
In cyber security, heap corruption matters because attackers often try to steer malformed network input into vulnerable parsers, deserializers, or file handlers. The result may be a crash, but in some cases the attacker can shape the corrupted heap state into code execution. Defenders look for strict bounds checks, safe allocation patterns, fuzz testing, and memory-safety tooling such as sanitizers or hardened allocators. When a bug report mentions “memory corruption” or “bad length handling,” heap corruption is often the underlying failure mode.