Difference between heap and stack overflow exploitation?

Stack overflow — overwrite return address on stack, redirect execution. Mitigations: stack canaries, ASLR, DEP/NX. Heap overflow — corrupt heap metadata or in-place objects to gain primitives (arbitrary read, arbitrary write, type confusion). Modern heap exploitation focuses on tcache poisoning (glibc), unsorted bin attack, House of Force. Mitigations: ASLR (heap randomised), tcache safelinking (glibc 2.32+), heap layout randomisation. Stack overflow exploitation is rarer in modern apps; heap and use-after-free are more common in browsers, kernels. CTF preparation differs significantly between the two.