---
title: "Memory-corruption bugs fell from 31% to 14% of exploited flaws"
summary: "Our count of CISA's catalogue of exploited flaws by bug type, November 2021 to 19 October 2026, and five questions to ask a vendor about memory safety."
url: https://www.thetechbag.com/blog/memory-corruption-share-exploited-flaws-falls
format: Trend
desk: "Security operations"
published: 2026-10-20
facts_checked: 2026-10-20
author: TechBag (The TechBag Journal)
tags: ["CISA KEV","memory safety","memory-safe languages","Rust","CWE","Cyber Resilience Act","Secure by Design","Google GTIG","edge devices","vulnerability management"]
cover: https://www.thetechbag.com/blog/covers/memory-corruption-share-exploited-flaws-falls.png
---

# Memory-corruption bugs fell from 31% to 14% of exploited flaws

*Our count of CISA's catalogue of exploited flaws by bug type, November 2021 to 19 October 2026, and five questions to ask a vendor about memory safety.*

Trend · Security operations · By TechBag · Published 2026-10-20 · Facts checked 2026-10-20 · Canonical: https://www.thetechbag.com/blog/memory-corruption-share-exploited-flaws-falls

The short version

- Memory-corruption bugs were 31% of the flaws CISA added to its list of exploited vulnerabilities in 2021 and 14% of those added in 2026 so far, by our count of 1,748 entries.
- The list does not say why. Google credits memory-safe languages for its own Android numbers; Google’s threat researchers point to attackers moving to enterprise appliances and to bugs that are easier to exploit.
- A buyer can ask for the evidence: US agencies asked makers to publish a memory-safety roadmap by the end of 2025, and the EU’s Cyber Resilience Act wants products shipped without known exploitable flaws. Five questions are below.

The kind of bug that dominated security for decades is a shrinking part of what attackers actually use. Of the flaws CISA added to its Known Exploited Vulnerabilities (KEV) catalogue in 2021 and tagged with a weakness type, 31% were memory corruption: a program writing or reading memory it should not touch, as in a buffer overflow or a use-after-free. Of those added between 1 January and 19 October 2026, 14% were.[1] These are the bugs that memory-safe languages such as Rust, Go, Java and C# rule out by design, and that C and C++ do not. Chromium’s engineers put them at “around 70%” of the browser’s high-severity security bugs.[2]

## The line: a third of exploited flaws, then a seventh

The fall is not a straight line. The share held near a third in 2022 (160 of 486 entries) and fell to 28% in 2023 (46 of 165). It dropped to 17% in 2024, rose to 22% in 2025, and stands at 14% this year: 35 of 255 entries.[1] On the same calendar window, 1 January to 19 October, 2025 was at 22.5%, so this year’s fall is not an artefact of a part year.

**Figure: Memory corruption has fallen from about a third of newly listed exploited flaws to about a seventh**

*Memory-corruption entries as a share of CISA KEV entries with a CWE tag, by year added, November 2021 to 19 October 2026*

|  | All entries with a CWE tag | Recent CVEs only |
| --- | --- | --- |
| 2021 | 30.9 | 35.8 |
| 2022 | 32.9 | 33.6 |
| 2023 | 27.9 | 29.9 |
| 2024 | 17.4 | 20.3 |
| 2025 | 21.8 | 25 |
| 2026 | 13.7 | 12.3 |

Source: CISA Known Exploited Vulnerabilities catalogue (JSON feed); TechBag count · as of 19 October 2026 · 2021 is the catalogue's launch list (3 November to 31 December). 2026 runs to 19 October. The second line keeps only CVEs from the year added or the year before.

TechBag countTechBag count

We counted every KEV entry added up to 19 October 2026 by the year CISA added it, and called it memory corruption when CISA tagged it with an out-of-bounds, overflow, use-after-free, double-free, type-confusion or bad-pointer weakness (the CWE list is in the method note). The catalogue’s first two months included a backlog of older flaws, so we also ran the count on recent CVEs only. It falls the same way, from 36% to 12%.

## What drives it: three readings, none proven by this data

KEV records that a flaw was exploited and what kind of weakness it is. It does not record why attackers chose it, or how much code behind it was written in which language. Three explanations are on the record, each from people who measured something else.

**Memory-safe code.** Google says memory-safety bugs fell from 76% to 24% of Android’s vulnerabilities between 2019 and 2024 “as development shifted to memory safe languages”, and that most bugs live in new code, so writing new code safely pays off fastest.[3] In November 2025 it reported the share below 20% for the first time, and a Rust density of 0.2 vulnerabilities per million lines against “closer to 1,000” for its C and C++.[4] That is Android’s own code, not the KEV list.

**Attackers moved.** Google’s Threat Intelligence Group (GTIG) counted 43 of 90 zero-days exploited in 2025, 48%, in enterprise software and appliances, about half of them in security and networking products. It wrote that command injection and deserialisation “often allow for reliable remote code execution without the complexity of memory corruption exploits”.[5] Verizon found edge devices and VPNs were 22% of exploitation targets in its 2025 report, up from 3%.[7]

**Hardening.** GTIG credited “vendor investments in exploit mitigations” for browser and mobile zero-days falling in 2024,[6] and read 2025’s low browser count as a sign “that browser hardening measures are working”, while adding that better attacker tradecraft may simply hide more of it.[5]

**Figure: Authentication and injection flaws grew as memory corruption shrank**

*Share of CISA KEV entries with a CWE tag, by bug family, entries added in 2021 against 2026 to 19 October*

|  | 2021 | 2026 | Change |
| --- | --- | --- | --- |
| Memory corruption | 30.9 | 13.7 | -17.2 pts |
| Authentication, access | 14.5 | 22.4 | 7.9 pts |
| Injection | 16.4 | 19.2 | 2.8 pts |
| Path traversal, upload | 10.4 | 10.6 | 0.2 pts |
| Deserialisation | 4.8 | 5.1 | 0.3 pts |

Source: CISA Known Exploited Vulnerabilities catalogue (JSON feed); TechBag classification · as of 19 October 2026 · An entry can carry tags in more than one family. 2021 is November and December only.

Memory corruption has not gone. GTIG put memory-safety issues at roughly 35% of 2025’s zero-days,[5] a narrower list than KEV, which also holds flaws exploited after a patch. And 10 of this year’s 35 memory-corruption KEV entries sit in network appliances: five in Citrix NetScaler, two in F5 BIG-IP, one each in FortiOS, PAN-OS and DD-WRT.[1] The two readings meet there: the edge is where attackers went, and some of it is still written in C.

## What it means for a buyer

Two governments have turned this into something a buyer can ask for. CISA and the FBI call it a “bad practice” to start new product lines for critical infrastructure in a memory-unsafe language such as C or C++ where alternatives exist, and asked makers of existing products to “publish a memory safety roadmap by the end of 2025”, starting with network-facing and cryptographic code. Products whose support ends before 1 January 2030 are exempt, and the guidance is voluntary.[8][9] We found no official count of which makers published one.

The EU’s Cyber Resilience Act names no language. Its Annex I requires products to be sold “without known exploitable vulnerabilities”, designed “to limit attack surfaces” and built with “exploitation mitigation mechanisms”; those duties apply from 11 December 2027.[10] Since 11 September 2026, makers must already report actively exploited flaws, with an early warning within 24 hours.[11] Our [15 September piece](https://www.thetechbag.com/blog/eu-cra-24-hours-exploited-flaw-india-6) sets out what that means for Indian exporters. We found no CERT-In, MeitY or NCIIPC guidance on memory-safe languages, so the US and EU texts are the reference an Indian buyer can point to.

Five questions to put to a vendor, in writing:

1. Have you published a memory-safety roadmap, and where can we read it?
2. What share of new code in this product is written in a memory-safe language, and since when?
3. Which internet-facing parts (the VPN or web front end, file and packet parsers, cryptography) are still C or C++?
4. How is code that bypasses the language’s checks, such as Rust’s `unsafe` blocks, reviewed and fuzzed?
5. What does the product do on input it does not expect? Memory safety does not stop a crash: on 18 November 2025 Cloudflare’s Rust proxy hit a hard limit, “panicked” and served errors.[12]

None of the five covers the families that grew. Authentication bypasses and injection flaws are just as possible in Rust as in C, so the answers belong beside a vendor’s patch record, not in place of it.

**What to watch.** CISA adds to the catalogue every few days; the full-year 2026 count closes on 31 December, and it will show whether 2026 holds below 2025 or bounces as 2025 did. Google’s next annual zero-day review is the second line to watch; the last two came in April 2025 and March 2026. The CRA’s product duties start on 11 December 2027.

How we did this

Figures as of 19 October 2026

Counts are ours, from CISA’s KEV JSON feed: 1,748 entries added from 3 November 2021 to 19 October 2026 (the latest on 16 October), grouped by date added, not by disclosure date. The denominator is entries carrying at least one CWE tag (9 of the 264 added in 2026 carry none). Memory corruption means any of CWE-119, 120, 121, 122, 123, 124, 125, 126, 127, 131, 415, 416, 785, 787, 788, 805, 806, 822, 823, 824, 825 and 843. Null-pointer dereference (CWE-476) and integer overflow (CWE-190, 191) are excluded unless the entry also carries a listed tag. “Recent CVEs only” keeps entries whose CVE year is the year added or the one before. The families in the second chart are our grouping of CWE tags (injection: 74, 77, 78, 88, 89, 94, 95, 96, 917, 1336; authentication and access: 250, 264, 266, 267, 269, 276, 284, 285, 287, 288, 290, 294, 303, 305, 306, 425, 522, 639, 798, 862, 863, 1390; path traversal and upload: 22, 23, 35, 36, 59, 61, 73, 434; deserialisation: 502). CWE tagging is uneven, and another list would move each share by a point or two. The data shows a change in mix; it does not show a cause.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [CISA, Known Exploited Vulnerabilities catalogue, JSON feed (date added and CWE tags per entry; TechBag count)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — entries added to 19 October 2026
2. [The Chromium Projects, Memory safety (912 high or critical severity bugs since 2015)](https://www.chromium.org/Home/chromium-security/memory-safety/) — undated page
3. [Google Online Security Blog, Eliminating Memory Safety Vulnerabilities at the Source (Jeff Vander Stoep, Alex Rebert)](https://security.googleblog.com/2024/09/eliminating-memory-safety-vulnerabilities-Android.html) — 25 September 2024
4. [Google, Rust in Android: move fast and fix things (Jeff Vander Stoep)](https://blog.google/security/rust-in-android-move-fast-fix-things/) — 13 November 2025
5. [Google Threat Intelligence Group, Look What You Made Us Patch: 2025 Zero-Days in Review](https://cloud.google.com/blog/topics/threat-intelligence/2025-zero-day-review/) — 5 March 2026
6. [Google Threat Intelligence Group, Hello 0-Days, My Old Friend: A 2024 Zero-Day Exploitation Analysis](https://cloud.google.com/blog/topics/threat-intelligence/2024-zero-day-trends) — 29 April 2025
7. [Verizon, 2025 Data Breach Investigations Report (edge devices and VPNs 22% of exploitation targets, from 3%)](https://www.verizon.com/business/resources/reports/2025-dbir-data-breach-investigations-report.pdf) — April 2025
8. [CISA and FBI, Product Security Bad Practices, version 2 (memory-unsafe languages; memory safety roadmap by the end of 2025)](https://www.cisa.gov/resources-tools/resources/product-security-bad-practices) — 17 January 2025
9. [CISA, The Case for Memory Safe Roadmaps](https://www.cisa.gov/resources-tools/resources/case-memory-safe-roadmaps) — 6 December 2023
10. [Regulation (EU) 2024/2847 (Cyber Resilience Act), Annex I Part I and Article 71 (reuschlaw reproduction)](https://cyber-resilience-act.com/annexes/annex-i/) — 23 October 2024
11. [European Commission, Cyber Resilience Act: reporting obligations](https://digital-strategy.ec.europa.eu/en/policies/cra-reporting) — updated 11 September 2026
12. [Cloudflare, Cloudflare outage on November 18, 2025 (postmortem)](https://blog.cloudflare.com/18-november-2025-outage/) — 18 November 2025

Related on TechBag: the [vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) and the [firewall and network security guide](https://www.thetechbag.com/browse/network-security-sase/firewall-network-security).

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

Go deeper on TechBag

- [Vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) — the scanners that rank flaws by exploitation, whatever the bug type
- [Firewall and network security guide](https://www.thetechbag.com/browse/network-security-sase/firewall-network-security) — the appliance class that carries 10 of this year's 35 memory-corruption KEV entries
- [Europe gives software makers 24 hours to report an exploited flaw; India gives 6](https://www.thetechbag.com/blog/eu-cra-24-hours-exploited-flaw-india-6) — the CRA reporting duty, live since 11 September 2026, for Indian exporters