A heap out-of-bounds read happens when a program uses a pointer or length that crosses past the end of a heap allocation and then copies or inspects memory it was never meant to access. Because the heap holds dynamic buffers, this bug often exposes adjacent data rather than causing immediate corruption.
In cyber security, this matters because memory disclosure can be just as useful as memory corruption. Leaked heap bytes may reveal file contents, credentials, object layouts, or address information that helps bypass hardening and prepare a follow-on exploit. Attackers often trigger this bug through crafted media, images, network replies, or other parsed input where size checks fail. Defenders look for strict bounds checking, safe length handling, and reduced exposure of untrusted parsers. Even when the result is only a crash, a heap out-of-bounds read is a serious bug because it can break confidentiality and weaken later defenses.