The White House has issued a call for software developers to move away from C and C++ in favor of memory-safe programming languages to bolster cybersecurity across critical systems.
What’s Happening: In a recent report, the White House Office of the National Cyber Director (ONCD) highlighted the security risks posed by memory-unsafe languages like C and C++. These languages, widely used in critical infrastructure, are prone to vulnerabilities such as buffer overflows and memory leaks, which can be exploited by attackers. The report urges developers to adopt memory-safe alternatives, such as Rust, Python, or Java, to reduce these risks. By January 1, 2026, software manufacturers are encouraged to publish memory safety roadmaps for existing products written in unsafe languages.
Why It Matters: The initiative stems from findings that memory-related bugs account for a significant portion of software vulnerabilities—up to 70% in some studies. These flaws can compromise national security, economic stability, and public safety, especially in sectors like healthcare, energy, and defense. The push for memory-safe languages aims to eliminate entire classes of errors by leveraging built-in protections like automatic memory management and bounds checking.
How It’s Being Approached: The guidance, while voluntary, is part of a broader “Secure by Design” strategy led by the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI. It emphasizes writing new code in memory-safe languages and gradually transitioning legacy systems. The report acknowledges challenges, such as performance trade-offs and the need for developer retraining, but positions the shift as critical for long-term security.
Our Take: The White House’s focus on memory safety is a pragmatic step toward reducing preventable cyber threats, but it raises questions about feasibility in high-performance computing, where C and C++ shine. These languages offer unparalleled control over memory and system resources, making them indispensable for applications like operating systems, game engines, and real-time simulations. Their efficiency and speed are why they’ve endured for decades, despite their risks.
Replacing C and C++ entirely seems ambitious, if not impractical, given the trillions of lines of legacy code powering critical systems. Transitioning to memory-safe languages like Rust, which balances safety with performance, could be viable for new projects, but rewriting existing codebases is a monumental task. Rust stands out as a strong candidate for replacement due to its low-level control and memory safety guarantees, though it demands a steep learning curve. Other options, like Python or Java, prioritize ease of use but often sacrifice the raw performance needed for certain domains.
Ultimately, we believe a hybrid approach—using C and C++ where performance is non-negotiable and integrating safer languages elsewhere—might strike the best balance. The industry must weigh security against practicality, ensuring innovation isn’t stifled by an all-or-nothing mandate.
Source: White House ONCD Report
