When an attacker is not able to directly input code to modify the control flow of a program, for example in presence of code injection defenses such as W^X, he or she can redirect the control flow to code sequences existing in memory.
