Runtime decoding is the process of parsing structured data while an application or virtual machine is running, rather than before execution. The input may be network messages, archive contents, serialized objects, or configuration records. Because the decoder operates on live, attacker-controlled data, small mistakes can become serious security flaws.
In cyber security, runtime decoding matters because it often sits on a trust boundary. If the parser accepts malformed lengths, nested structures, or unexpected encodings, an attacker may trigger crashes, memory corruption, logic bypasses, or resource exhaustion. Defenders look for strict input validation, bounded parsing, and robust error handling. In distributed systems and runtimes such as Erlang/OTP, decoding is especially sensitive because one bad message can affect many services that rely on the same parsing path.