Memory safety
Freedom from memory-access errors such as out-of-bounds reads and writes, use-after-free and double free. Memory-safe languages, including Rust outside unsafe blocks, Go, Java, C#, Python and Swift, rule these classes out by construction; CISA and partner agencies urge vendors to publish roadmaps for moving to them.
- Also called
- memory-safe language
Covered in
Find, fix and contain memory-safety bugs in C and C++
Recognize out-of-bounds access, use after free, NULL dereference and integer overflow in C and C++, fix them with checked lengths and single ownership, harden release builds, catch the rest with sanitizers and fuzzing, and plan new code in a memory-safe language.
Audit unsafe Rust, FFI boundaries and crate dependencies
Know what the Rust compiler proves and what it leaves to you: review unsafe code for soundness, wrap foreign calls in small safe functions, decide how overflow and panics behave in release builds, gate crates with RustSec, and replace C one boundary at a time.
Apply CISA Secure by Design: principles, pledge goals and evidence
What CISA's Secure by Design guidance and pledge ask of software manufacturers as of October 2026, and how to turn each of the three principles, the seven pledge goals and the Product Security Bad Practices into engineering actions, metrics and evidence.
Fuzz a parser and turn crashes into lasting regressions
Build a narrow harness, observe memory and resource failures, minimize the input, and test the repaired parser.
Case study: Citrix Bleed (CVE-2023-4966)
How a NetScaler memory over-read leaked session cookies that bypassed passwords and MFA in 2023, why patching did not end hijacked sessions, and how the pattern returned in 2025.
Convert untrusted office documents and PDFs in an isolated parser
DOCX, XLSX and ODF files are ZIP archives of XML, and PDFs can carry scripts; the converters that read them are large C and C++ programs with a long CVE history. Check the package before any parser reads it, convert each document in a container with no network, no writable root and hard limits, kill it at a deadline, and re-render to pixels when people will open the result.
Practice: Buffer over-read lab: Stop a heartbeat over-read · Local project: Parse bounded JSON and XML invoices safely · Local project: Repair a native parser using sanitizer evidence · Local project: Convert untrusted documents in a locked-down container