Heap memory is the part of an application’s runtime memory used for dynamic data storage. Programs allocate heap space when they need objects, buffers, messages, or other data whose size or lifetime is not known in advance. Unlike stack memory, heap data can stay live for longer and is managed by the program or runtime through allocation and cleanup.
Heap memory matters in cyber security because it often holds sensitive information while an app is running, such as session tokens, chat content, credentials, or file fragments. If an attacker gains a read primitive, debug access, or an information disclosure bug, they may extract data directly from memory even without breaking encryption or bypassing authentication. Defenders reduce this risk by fixing memory-access bugs quickly, limiting what sensitive data stays in memory, zeroing buffers when possible, and using safer coding practices to prevent out-of-bounds reads and use-after-free errors.