Out-of-memory handling is the code that runs when a program cannot allocate the memory it needs. It may report an error, abandon an operation, or clean up resources. These failure paths must leave data structures and program state consistent; otherwise, later code may use partially initialized or invalid data.
In security-sensitive software, a flaw in this handling can turn resource exhaustion into a memory-safety or logic bug. For example, a web runtime processing an untrusted request may fail an allocation, then mishandle request data during cleanup. Attackers may be able to trigger such paths with crafted input, while defenses include fixing the affected code, applying vendor patches, and monitoring for unusual crashes or resource exhaustion. Robust software also checks allocation failures and performs safe, complete cleanup.