How malleability ussue works?
First of all, exchanges keep track of transactions by their TXIDs. The TXID can be changed by 3rd parties, but not the transaction data.


  I can't understand how, say, Bob can change Alice's signature in a Alice->Bob transaction if that signature doesn't belong to him in the first place.


Old versions of Bitcoin Core used OpenSSL to verify signatures (now libsecp256k1). OpenSSL is lenient about signature encoding.


An ECDSA signature is an (R,s) pair. (R,-s) also makes a valid signature.
OpenSSL allows encoding algorithms other than DER.


which means there are more than one possible way to encode signatures. Different but equivalent signatures allow 3rd parties to change the signatures without knowing the private key, thus changing the TXID.

Details: BIP 62