I discovered a vulnerability and tried exploiting it all. If you analyze it, HEAP is big Every time you assign a note One note structure (fixed size 0x20) One note name (variable size) One note content (fixed size 0x100) I've confirmed that these three are being allocated. In conclusion, I discovered UAF and used it FD LEAK of HEAP (name, content)