{"id":26162,"date":"2026-09-21T15:05:33","date_gmt":"2026-09-21T23:05:33","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/09\/21\/memory-safe-programming-goes-from-advocacy-to-adoption\/"},"modified":"2026-09-21T15:05:33","modified_gmt":"2026-09-21T23:05:33","slug":"memory-safe-programming-goes-from-advocacy-to-adoption","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2026\/09\/21\/memory-safe-programming-goes-from-advocacy-to-adoption\/","title":{"rendered":"Memory-safe programming goes from advocacy to adoption"},"content":{"rendered":"<div class=\"rich-text_richText__UyrDZ\" data-anchor-headings=\"true\" data-component=\"rich-text\" data-reader-view=\"false\">\n<div class=\"payload-richtext\">\n<div class=\"callout-block_highlight__zUB32\" data-accent-bar=\"true\" data-background=\"highlight-gray\" data-component=\"callout-block\">\n<p class=\"callout-block_heading__sSD7c\" data-subtitle=\"lg\">Key takeaways<\/p>\n<div class=\"rich-text_richText__UyrDZ\" data-component=\"rich-text\" data-reader-view=\"false\">\n<div class=\"payload-richtext\">\n<ul class=\"list-bullet\">\n<li class=\"\" value=\"1\">CISA\/NSA&#8217;s report cited memory-safety issues behind 66-71% of major OS CVEs and 75% of in-the-wild exploited vulnerabilities, driving real adoption momentum.<\/li>\n<li class=\"\" value=\"2\">Adoption faces real headwinds: legacy C\/C++ is too vast to rewrite wholesale, and experts say MSLs work best for new code, not replacing proven systems.<\/li>\n<li class=\"\" value=\"3\">AI is accelerating migration (Google&#8217;s Gemini-assisted Rust rewrite of <em>giflib<\/em> is an early proof point), but human review is still required \u2014 the AI-generated code itself had defects.<\/li>\n<li class=\"\" value=\"4\">MSLs aren&#8217;t a cure-all. They eliminate one class of bugs (like buffer overflows) but leave logic errors and other flaws untouched, so most expect legacy risk to persist for decades.<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n<p>Just over a year ago, the U.S. Cybersecurity and Infrastructure Security Agency and the National Security Agency released their report on the state of memory-safe languages, and since then, momentum has been building for wider adoption of MSLs, fueled by several major technology providers and <a href=\"https:\/\/www.reversinglabs.com\/blog\/ai-coding-rust\">advances in AI-assisted coding<\/a>.<\/p>\n<p>The CISA\/NSA report emphasized the vital importance of memory safety. It cited a 2019 study estimating that 66% of Common Vulnerabilities and Exposures (CVEs) for iOS 12 and 71% of CVEs for macOS Mojave stemmed from memory safety issues. And it underlined how severe the consequences of memory-safety vulnerabilities can be, ranging from data breaches to system crashes and operational disruptions. It pointed to a Google Project Zero review of exploits detected in the wild, which estimated that 75% of the CVEs used in those exploits were memory safety vulnerabilities.<\/p>\n<p>Of the 58 in-the-wild zero days discovered in 2021, 67% were memory-safety vulnerabilities, Google found. Adopting memory-safe languages, the CISA\/NSA report concluded, is a key strategy for improving software security and reducing the risk of costly incidents.<\/p>\n<p>The report argued that defining memory-safety road maps and adopting best practices can meaningfully improve software resilience across the industry, stating, \u201cStrategic [MSL] adoption is an investment in a secure software future.\u201d<\/p>\n<p>All of this has led to real action. Major cloud and software providers are no longer just endorsing MSLs such as Rust \u2014 they\u2019re building them into production systems, and AI tools are starting to lower the cost of migrating decades-old code.\u00a0<\/p>\n<p>But the shift is far from settled. Security practitioners caution that legacy C and C++ code is too widely deployed and deeply embedded to replace wholesale and that MSLs solve only one category of vulnerability, not all of them.<\/p>\n<p>Here\u2019s what you need to know about the state of MSL adoption.<\/p>\n<p><strong>[ Webinar: <\/strong><a href=\"https:\/\/www.reversinglabs.com\/events\/red-team-build-pipeline\"><strong>Go hands on with a red team vs. the build pipeline<\/strong><\/a><strong> ]<\/strong><\/p>\n<h2 id=\"implementation-efforts-are-getting-concrete\"><strong>Implementation efforts are getting concrete<\/strong><\/h2>\n<p>Boris Cipot, a security engineer at Black Duck Software, said awareness about memory safety is no longer the problem. We\u2019ve stopped debating whether memory-related flaws are among the largest sources of security defects, and the industry is adopting MSLs. \u201cMajor technology providers such as Microsoft, Google, Amazon, Cloudflare, and parts of the Linux ecosystem are actively adopting Rust or other memory-safe approaches in production systems,\u201d Cipot said.<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cThe recent NSA and CISA guidance reflects this shift by focusing not on whether memory-safe languages are beneficial, but on how organizations can realistically adopt them.\u201d<\/em><br \/>\u2014<a href=\"https:\/\/www.linkedin.com\/in\/boris-cipot-58a0a620?originalSubdomain=de\"><span style=\"text-decoration:underline\">Boris Cipot<\/span><\/a><\/p>\n<p>John Strand, owner of Black Hills Information Security, traces that shift to a specific milestone.<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cWhen you started seeing Rust incorporated into the Linux kernel, that was kind of the opening shot in the race to see this become more mainstream. And I think we\u2019re just going to see it become more mainstream moving forward.\u201d<\/em><br \/>\u2014<a href=\"https:\/\/www.linkedin.com\/in\/john-strand-a1b4b62\/\"><span style=\"text-decoration:underline\">John Strand<\/span><\/a><\/p>\n<h2 id=\"why-its-still-an-uphill-battle\"><strong>Why it\u2019s still an uphill battle<\/strong><\/h2>\n<p>Not everyone expects a quick transition to MSLs. Jeff Williams, chief technology officer and co-founder of Contrast Security, foresees stubborn inertia.<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cThere is an entire mountain range of software built in non-memory-safe languages. And there is a tiny amount of action in the foothills to switch.\u201d<\/em><br \/>\u2014<a href=\"https:\/\/www.linkedin.com\/in\/planetlevel\"><span style=\"text-decoration:underline\">Jeff Williams<\/span><\/a><\/p>\n<p>MSL adoption is best for new development, Williams said; rewriting software that already works is a massive undertaking with an uncertain payoff. Eliminating one class of vulnerability, he added, is likely to introduce others, and there\u2019s no guarantee organizations will abandon software versions already proven in production.<\/p>\n<p>Dmitry Polyakovsky, a lead principal platform software engineer at Oracle, concedes that point but nonetheless expects Rust to continue to make inroads even as legacy C and C++ code remains in place.\u00a0<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cRust can be a bridge for integrating new features into existing complex C\/C++ codebases. As more developers become comfortable with Rust, new projects will be started in Rust from the beginning.\u201d<\/em><br \/><em>\u2014<\/em><a href=\"https:\/\/www.linkedin.com\/in\/dmitrypol\"><span style=\"text-decoration:underline\">Dmitry Polyakovsky<\/span><\/a><\/p>\n<p>The sheer volume of legacy code is only one factor slowing the shift toward MSLs such as Rust, said Jason Soroko, a senior fellow at Sectigo. Migration is gradual, he said, because teams must learn new tools, preserve compatibility, and verify that replacements meet performance requirements without changing behavior. A full rewrite can introduce new errors and disrupt working systems, which is why the NSA\/CISA guidance recommends starting with new code and targeting components that handle untrusted files or network traffic.<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cMixed systems make sense where dependencies or operational constraints prevent replacement, but retained code still needs hardening and testing.\u201d<\/em><br \/>\u2014Jeff Williams<\/p>\n<h2 id=\"why-adoption-is-enabled-by-ai-coding\"><strong>Why adoption is enabled by AI coding<\/strong><\/h2>\n<p>AI is emerging as a tool for migrating legacy code, Soroko said, pointing to Google\u2019s Gemini-assisted rewrite of giflib, a GIF image library, as an early proof point: Google\u2019s Rust replacement was unaffected by a memory-corruption flaw later disclosed in the original C library, meaning migrated systems never needed a patch for that flaw.<\/p>\n<p>John Bambenek, president of Bambenek Consulting, said the benefit extends beyond the systems that migrate outright.<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cHaving memory-safe libraries not only protects memory-safe applications, but also helps protect applications written in non-memory-safe languages. \u2026 Anything that reduces the attack surface is a win.\u201d<\/em><br \/><em>\u2014<\/em><a href=\"https:\/\/www.linkedin.com\/in\/johnbambenek\/\"><span style=\"text-decoration:underline\">John Bambenek<\/span><\/a><\/p>\n<p>The process isn\u2019t fully automated, Soroko cautioned. The initial AI-generated interface in the Gemini rewrite contained memory-handling defects, and human experts had to review the unsafe code before it could ship. \u201cAI helped write the replacement, but deployment still required evidence that it worked,\u201d he said.<\/p>\n<p>Bambanek noted that AI is greatly accelerating vulnerability discovery. That being the case, preventing entire classes of memory bugs can reduce the workload of finding, fixing, and distributing patches one at a time. In effect, he said, it makes memory safety part of managing the patching load, not just a coding best practice. \u201cAI vulnerability discovery really is at-scale fuzzing and code analysis,\u201d he said. \u201cIf you take away the possibility of buffer overflows entirely, that\u2019s a huge chunk of the problem space gone.\u201d<\/p>\n<p>Memory-safe code isn\u2019t immune to every flaw, Soroko warned; logic errors and legacy interfaces remain places where memory safety can fail. David Svoboda, a software security engineer at the CERT Division of the Software Engineering Institute at Carnegie Mellon University, made the same point more bluntly.<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cMemory-safe languages are not a panacea. While they make memory-safety problems manageable, they can leave code vulnerable to other problems, such as leaking sensitive information.\u201d<\/em><br \/><em>\u2014<\/em><a href=\"https:\/\/www.linkedin.com\/in\/david-svoboda-2246a41a\"><span style=\"text-decoration:underline\">David Svoboda<\/span><\/a><\/p>\n<h2 id=\"viable-strategy-for-improving-memory-safety\"><strong>Viable strategy for improving memory safety<\/strong><\/h2>\n<p>Black Duck\u2019s Cipot said large-scale rewrites have historically been limited by available engineering resources, but AI may be changing that calculus. \u201cGoogle\u2019s experiment suggests that AI may become a practical accelerator for modernizing legacy code and migrating security-sensitive components to memory-safe languages,\u201d he said.<\/p>\n<p>That doesn\u2019t mean AI can safely rewrite every C or C++ project on its own, he cautioned; human review, testing, validation, and security analysis remain essential. Still, he said, the experiment offers evidence that AI-assisted migration could become a viable strategy for reducing technical debt and improving memory safety at scale, and it could lower one of the biggest barriers to adoption: the cost of converting existing codebases.<\/p>\n<p>Contrast Security\u2019s Williams called the use of AI to rewrite C libraries in Rust a \u201cfantastic use case that we should try to scale.\u201d Testing a rewrite against an existing library as a model, he explained, makes it possible to verify with a high degree of certainty that the behavior hasn\u2019t changed.<\/p>\n<p>The progress is real, but Williams was careful to put it in context. The shift away from non-memory-safe languages started when Java was released in the 1990s, he pointed out, and three decades later, C and C++ remain everywhere.<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cUltimately, security is only one of a dozen different reasons that a developer might choose a particular language. And it\u2019s probably not the first one on the list. So I\u2019d be willing to bet that we\u2019ll still be dealing with buffer overflows in another 30 years.\u201d<\/em><br \/>\u2014Jeff Williams<\/p>\n<\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Key takeawaysCISA\/NSA&#8217;s report cited memory-safety issues behind 66-71% of major OS CVEs and 75% of in-the-wild exploited vulnerabilities, driving real adoption momentum.Adoption faces real headwinds: legacy C\/C++ is too vast to rewrite wholesale, and experts say MSLs work best for new code, not replacing proven systems.AI is accelerating migration (Google&#8217;s Gemini-assisted Rust rewrite ofgiflibis an early proof point), but human review is still required \u2014 the AI-generated code itself had defect<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[32775],"tags":[],"class_list":["post-26162","post","type-post","status-publish","format-standard","hentry","category-reversinglabs"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26162","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=26162"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26162\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=26162"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=26162"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=26162"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}