Tags: pwn heap 

Rating:

## tl;dr

+ Overflow the char candle counter stored in the wax structure and trigger uaf.
+ Use the uaf to trigger double free and get shell.

Original writeup (https://blog.bi0s.in/2020/10/30/Pwn/HackTheVote-leakguard/).