A vulnerability is used to alter either program execution or data state. Execution after this is either a weird state or a state operating on unintended data.