The C and C++ programming languages are now over 50 and 40 years old respectively. The familiarity of these languages with two generations of programmers, their suitability to system programming, performance, and a legacy of code reuse means that many major operating systems and applications are written in these languages.

Although languages like C and C++ offer low-level access to memory and efficiently map to CPU instructions, features such as pointers also increase the risk of programming mistakes. These bugs can easily lead to memory safety issues such as overflowing a memory allocation, or unintentionally accessing objects of the wrong type. These bugs then become vulnerabilities. They can be triggered by an attacker and the system can be maliciously manipulated into unintended behaviour. Even after engineering best practice and careful programming are taken into account, major industry studies indicate that memory safety issues lead to over 70% of software vulnerabilities.

Other languages such as Rust, Java and C# have been designed to be memory-safe and won’t let a programmer make an out-of-bounds memory access.  Safety is ensured by generating additional code to perform runtime checks, but this has a performance penalty.

Get involved to become part of a forward-thinking community of professionals exploring cybersecurity. Get in touch if you wish to find out more about the benefits of experimenting with Digital Security By Design technology.