Every process has a limit, set by the system, the container or the program's own configuration. When a request or task needs more than that, allocation fails. The program may stop with an error, be killed by the system or, in the worst case, behave unpredictably.
It can happen by accident, through a large file or a heavy query, or on purpose, when an attacker sends input designed to use a lot of memory. This is a common route to denial of service. In PHP, hitting memory_limit ends the request with a fatal error.
Exhaustion is the event. Out-of-memory handling is what the program does about it. A program that handles it well simply stops the request. One that handles it badly can end up with corrupted state, which is why exhaustion sometimes appears in advisories about code execution as well as denial of service.
Sensible limits on request size, upload size and memory per process reduce the risk. They help, but they do not replace patching a flaw that is triggered by exhausting memory.