The US government, through the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI), is aggressively pushing software manufacturers and developers to abandon using memory-unsafe programming languages like C and C++ by 2026. This directive aims to significantly reduce the risk of security breaches and vulnerabilities in critical software and infrastructure.
Table of Contents
C/C++ are Memory-Unsafe Programming Languages
The government’s report, “Product Security Best Practices,” highlights that the use of memory-unsafe languages such as C/C++ “is dangerous. These languages significantly elevate risk to national security, national economic security, and national public health and safety.” They lack inherent memory protections, making them susceptible to common memory-related issues like buffer overflows and use-after-free vulnerabilities, which threat actors can exploit.
Roadmap to Memory-Safe Alternatives
The CISA and FBI have set a deadline of January 1, 2026, for software manufacturers. They need to either provide a roadmap for eliminating memory safety vulnerabilities in existing C/C++ codebases or migrate to memory-safe alternatives. Alternatively, they should transition to using memory-safe languages approved by the NSA.
Recommended Alternatives Over C/C++
To address this issue, the government is encouraging developers to transition to memory-safe programming languages, such as Rust, Java, C#, Go, Delphi/Object Pascal, Ruby, Python, and Swift. These languages incorporate built-in protections against common memory-related errors, making them more secure from the ground up.
Migration Challenges in Transitioning From C/C++
However, migrating existing large codebases to these new languages is no easy task. It’s time-consuming, resource-intensive, and requires careful planning to maintain functionality. Many developers have deep expertise in these legacy languages. They are reluctant to adopt the radically different Rust, which the government is promoting as a preferred alternative.
Companies also face the expense of replacing development tools, debuggers, and testing frameworks to support the new languages, as well as integrating the new programs with the old code and libraries.
Concerns About Slow Performance
Despite the US government’s push, the transition away from C/C++ is expected to be a slow and gradual process. Additionally, there are concerns about potential performance slowdowns with memory-safe languages compared to C/C++, which are prized for their ability to produce the fastest programs. Developers and companies often prioritize speed over security, making the transition even more challenging.
Consequences for Noncompliance
While the government’s report is not legally binding, it sends a clear message that using memory-unsafe languages is unacceptable for any software used in critical infrastructure or national critical functions. Failure to comply with the recommendations could potentially disqualify manufacturers from government contracts and work related to national security.
Concluding Remarks
The US government’s directive to push developers to abandon C/C++ by 2026 is necessary to enhance the security of critical software and infrastructure. However, the path to achieving this goal remains uncertain. This will likely require sustained effort and collaboration between the public and private sectors.
| Latest From Us
- Forget Towers: Verizon and AST SpaceMobile Are Launching Cellular Service From Space

- This $1,600 Graphics Card Can Now Run $30,000 AI Models, Thanks to Huawei

- The Global AI Safety Train Leaves the Station: Is the U.S. Already Too Late?

- The AI Breakthrough That Solves Sparse Data: Meet the Interpolating Neural Network

- The AI Advantage: Why Defenders Must Adopt Claude to Secure Digital Infrastructure







