A penetration tester discovers Heartbleed vulnerabilities in a target network Which of the following impacts would be a result of exploiting this vulnerability?

Heartbleed is a passive information disclosure vulnerability that reads existing memory contents - it cannot write to or execute arbitrary code on the affected system.

Heartbleed does not require a man-in-the-middle network position; the attacker sends malicious heartbeat packets directly to the vulnerable server and receives leaked memory directly in the TLS response.

Heartbleed exploits a missing bounds check in OpenSSL's TLS heartbeat extension, allowing an attacker to read up to 64KB of server memory per malicious heartbeat request without authentication. This leaked memory frequently contains active session tokens and session IDs belonging to currently authenticated users. An attacker who captures these session identifiers can replay them to impersonate those users without knowing their passwords.

Public certificate contents are already publicly distributed and provide no decryption capability; it is the server's private key (which Heartbleed can also leak) that enables traffic decryption, making this description technically inaccurate.