Use-after-free vulnerabilities Allocate objects Doc Doc *doc new Doc(); Body *body new Body(); *doc *child Propagate pointers doc->child body; a dangling pointer Body Free an object Attacker delete body; control *body object Use a dangling pointer if (doc->child) doc->child->getAlign(); 17Use-after-free vulnerabilities 17