> Data-only attacks ... have long been considered too sophisticated and niche to pose a practical threat.<p>I thought the whole point of fuzzing was an example of finding data-only attacks.
Corrupting program memory via input data is known as a code-execution attack, the fuzzed program crashes because its executable code got overwritten directly by the input, or it got overwritten indirectly by the logic when it tries to process bad data.<p>A data-only attack would be an attack that reuses the original logic without injecting any executable code into the program.