Rating:
Using UAF to overwrite vtable pointer:
https://kileak.github.io/ctf/2017/BCTF-BabyUse/
I don't remember