Undefined behavior occurs when a program performs an operation that its programming language or runtime does not specify how to handle. The result may vary: the program might crash, produce incorrect output, corrupt memory, or appear to work normally. In languages such as C and C++, invalid memory access and some use-after-free errors can trigger undefined behavior.
It matters in cyber security because unpredictable memory behavior can undermine software reliability and, in some cases, create conditions attackers can exploit. A use-after-free bug, for example, may let code access memory after an object has been released; the outcome depends on how that memory is reused and the surrounding program. Developers reduce risk with memory-safe languages, careful lifetime management, sanitizers, and testing. For defenders, promptly applying browser and software patches helps address defects that may lead to undefined behavior.