Unsafe unlink to dl_resolve

Single printf call with user-controlled input stored on heap

Off-by-one access to free arbitrary memory

ARM format string into rop

Calling functions via format string

Vtable Hijacking via Heap Feng Shui

Leaking via overflow into CRC calculation

Combining race conditions with an integer overflow