Does anyone have an explanation as to how a double free bug becomes a security vulnerability? I mean, asside than "a double free is when you free() a pointer twice..."

IE:
How does free() behave when double freeing?
What makes it possible to execute arbitrary code when exploiting a double free?


Ammo