NEW YORK — What happened: In late September 2026, CISA alongside international cybersecurity partners released an interim report assessing government and contractor progress toward eliminating memory-unsafe code. The report shows that 40% of newly written system-level code across critical government vendors now uses memory-safe programming languages, primarily Rust.
Why it matters: Memory corruption vulnerabilities—such as buffer overflows and use-after-free errors—have historically accounted for over 70% of high-severity software security flaws. Transitioning kernel drivers, network stacks, and security tools to memory-safe languages removes an entire class of security bugs by default at compile time.
Deep dive: The report details significant success in replacing network daemon libraries and storage drivers. However, it also emphasizes that hundreds of millions of lines of legacy C and C++ code remain active in operational environments. Organizations cite high costs, lack of specialized developers, and risk of introducing new logic bugs during refactoring as major bottlenecks.
Report check: Verified figures confirm that new infrastructure projects show a 35% decline in memory-related CVE filings over the past twelve months. Claims that all federal legacy software will be fully migrated by 2028 are widely considered unrealistic by industry auditors.
Open questions: Can automated code conversion and AI-assisted refactoring tools safely speed up legacy C-to-Rust migration without introducing unintended runtime bugs?