A third-party component is software created by a vendor other than the maker of the product that includes it. Products may bundle libraries, frameworks, or runtime components to provide features without building every part from scratch. These components can have their own vulnerabilities and may require separate security updates.
In cyber security, a flaw in a bundled component can put the whole product at risk, even when the product maker’s own code is not affected. Attackers may target a vulnerable component through the application or service that exposes it. Defenders should identify components and versions in their software inventory, check vendor advisories for affected products, and apply the relevant patches. A broad security update may cover both a vendor’s code and third-party components, so teams should verify which deployed products and versions need action.