C++20 introduced coroutines, I cant wait to abuse them! 1. To get a leak, look into c++ Small String Optimization. 2. Lambda capture variable is stored in the stack, you can overwrite it somehow. if you figure out what its overwritten with, solving this is straightforward.