A theory for decades of C vulnerabilities

This article presents a theoretical framework explaining decades of C language vulnerabilities—including buffer overflows, use-after-free, and integer overflows—as failures of semantic invariants, properties that must remain true for program correctness but are often maintained only as informal programmer obligations rather than enforced by the language. For IT leaders, this indicates that many security breaches stem from fundamental language design gaps rather than individual coding errors, underscoring the strategic importance of transitioning to memory-safe languages and implementing stronger type systems that encode these invariants. The implications are significant: organizations relying heavily on C-based systems face inherent architectural security risks that code review and testing alone cannot fully mitigate.