This type of vulnerability is still widely used, despite all the exploit mitigations that were introduced in the later versions of Windows. These vulnerabilities are common in scripting languages such as JavaScript in browsers or PDF files, VBScript in Office applications, or any other scripting language that is used inside an application.
This vulnerability occurs when an object (a structure in memory, which we will cover in detail in the next chapter) is still being referenced after it was freed. Imagine that the code looks something like so:
OBJECT Buf = malloc(sizeof(OBJECT));
Buf->address_to_a_func = IsAdmin();
free(Buf);
.... <some code> ....
//execute this function after the buffer was freed
(Buf->address_to_a_func)();
In the preceding code, Buf contains the address of the IsAdmin() function, which was executed later, after the whole Buf variable was freed in memory. Do you think address_to_a_func will still be pointing to IsAdmin()? Maybe...
