#tcache-poisoning CTF challenges

42 CTF challenges using tcache-poisoning from 34 CTFs (2018–2026), 42 with writeups. Mostly Misc (57%) and Pwn (43%).

Misc · 24 Pwn · 18

Often combined with

#use-after-free 8 #one-gadget 5 #double-free 4 #free-hook-overwrite 2 #negative-index 2 #malloc-hook 2 #free-hook 2 #poison-null-byte 2 #overlapping-chunks 2 #out-of-bounds-write 2 #malloc-hook-overwrite 2 #libc-leak 1 #fastbin-fd-overwrite 1 #safe-linking 1 #orw-rop 1

Challenges

Filter and sort these in the challenge browser →