Comment by megous

Not all UAF are explotiable. It really depends on what code that uses the stale pointer does with it and how controllable the freed/re-used data are. Although when evaluating I'd count much more on the first condition, rather than the second one, which may not be so easy to ascertain.