If an application crashes, the program stops and there is nothing anyone can do about it, other than starting the program again.

Crash is a bad behaviour in general and should be avoided, but why are they seen as security vulnerability?


It crashed because some input was not processed correctly. An attacker may try to find the code path that leads to the faulty procedure and attempt to execute arbitrary code through potential vulnerabilities.
Crashes may give an attacker valuable information about the system and its internal details.
Crashes may create temporary vulnerabilities or leave unprotected files (e.g. memory dumps) that may be exploited.
(Thanks and a hat tip go to Ladadadada) The application that crashes needs to be restarted, which obviously takes time (even with watchdogs and symmetric failover schemes). If an attacker replicates the conditions leading to the crash your service will suffer from prolonged outage (Denial-of-service) which means financial, reputation, and other losses.
