A new comparison of memory safety CVEs in Rust and C/C++ finds the two language ecosystems differ not in whether they ship vulnerabilities but in what kind.
Jakub Beránek, a Rust contributor known online as kobzol, published a technical breakdown examining how memory safety-related CVEs differ between software written in Rust versus C or C++. The analysis centers on a well-documented gap: C and C++ codebases regularly produce use-after-free, buffer overflow, and heap corruption bugs that Rust's ownership and borrow checker prevents at compile time. Rust-written software does still accumulate CVEs, but the pattern looks different - concentrated in logic errors, integer issues, and code that opts into unsafe blocks where the compiler's guarantees are suspended.
The distinction matters most to policymakers. The White House Office of the National Cyber Director and CISA have both issued guidance pushing organizations toward memory-safe languages, with Rust frequently cited as the model. A blanket reading of that guidance - that switching to Rust will slash your CVE count - sets up a false expectation. The shift in vulnerability type is real and meaningful, but developers can still write buggy, exploitable Rust.
Rust's ownership model is a genuine engineering advance. The compiler catches one specific class of failure; it was never designed to catch all of them.