New analysis shows memory-safety CVEs in Rust vs. C/C++ are fundamentally different in nature

A new technical analysis by developer Jakub Beránek, published June 15, argues that comparing raw CVE counts between Rust and C/C++ is misleading because the nature of memory-safety vulnerabilities differs fundamentally between the two languages. The post explains that Rust's ownership and borrowing model prevents entire classes of memory errors that plague C/C++ codebases — particularly those caused by manual memory management and pointer arithmetic — while Rust CVEs that do exist tend to stem from logic bugs or unsafe code blocks rather than systemic memory unsafety. Beránek notes he encounters this flawed comparison both online and when teaching Rust to C/C++ programmers.

A developer published a detailed breakdown showing that when people compare CVE counts between Rust and C/C++, they're comparing apples to oranges. Rust's ownership model prevents the kinds of deep memory-unsafety exploits that C/C++ is known for — its CVEs tend to be logic bugs or issues in \`unsafe\` blocks, not the pointer-arithmetic nightmares that make C/C++ a security liability. The author says he keeps