The vulnerability as described in ISO/IEC 24772-1:2024, 6.46 applies to C++.
Libraries that supply objects or functions are in most cases not required to check the validity of parameters passed to them. In those cases where parameter validation is required there might not be adequate parameter validation.
When calling a library, either the calling function or the library can make assumptions about parameters. For example, it can be assumed by a library that a parameter is non-zero so division by that parameter is performed without checking the value. It can also be the case that some validation is performed by the calling function, but the library uses the parameters in ways that were unanticipated by the calling function, resulting in a potential vulnerability. Even when libraries do validate parameters, their response to an invalid parameter can cause unanticipated results.
This vulnerability applies in particular to C++ libraries which are designed for high efficiency; responsibility for satisfying the preconditions for most functions rests with the caller. When these preconditions are not met, the result can be undefined behaviour [EWF]. In addition, error conditions are specified by the language for specific functions, such as raising an exception, returning an error code or a known value, such as NaN.
To avoid the vulnerability or mitigate its ill effects, C++ software developers can:
apply the avoidance mechanisms of ISO/IEC 24772-1:2024, 6.47.5;
use translation modes provided by the implementation to perform addition analysis or checking, such as contracts checks, or instrumentation of executing code; and
pay attention to the distinction between precondition violation and error conditions in library documentation: the former results in undefined behaviour; the latter results in defined but possibly unwanted behaviour.