{"id":5055,"date":"2026-07-26T12:05:34","date_gmt":"2026-07-26T16:05:34","guid":{"rendered":"https:\/\/www.wholetomato.com\/blog\/?p=5055"},"modified":"2026-07-26T12:08:10","modified_gmt":"2026-07-26T16:08:10","slug":"c26-memory-safety-what-actually-ships-for-existing-code","status":"publish","type":"post","link":"https:\/\/www.wholetomato.com\/blog\/c26-memory-safety-what-actually-ships-for-existing-code\/","title":{"rendered":"C++26 Memory Safety: What Actually Ships for Existing Code"},"content":{"rendered":"<p>Search for <strong>&#8220;C++26 memory safety&#8221;<\/strong> and the results won&#8217;t agree with each other. One post declares C++ finally memory-safe. The next, titled something like <em>&#8220;C++26 memory features won&#8217;t save you,&#8221;<\/em> says nothing important changed.<\/p>\n<p>In reality, no one serious would believe either extreme. Everyone writing C++ knows the language isn&#8217;t memory-safe; that&#8217;s the reason an entire generation of languages, Rust chief among them, exists to solve that one problem. The latest standard revision is a step to alleviate but not fully solve it.<\/p>\n<p>But between the victory laps and the dismissals, it is genuinely hard to get a straight answer to the only question that matters if you maintain an existing C++ codebase: <strong>what should I implement and use, and what does it get you?<\/strong><\/p>\n<p data-sourcepos=\"40:1-40:83\"><strong>tl;dr:<\/strong> Here&#8217;s the short version, because the search results won&#8217;t give it to you straight:<\/p>\n<ul data-sourcepos=\"42:1-46:0\">\n<li data-sourcepos=\"42:1-42:57\"><strong>Did C++26 make C++ memory-safe the way Rust is?<\/strong>\u00a0No.<\/li>\n<li data-sourcepos=\"43:1-43:153\"><strong>Did the safety Profiles everyone was talking about land in C++26?<\/strong>\u00a0No. They slipped to the next standard cycle and are currently targeted for C++29.<\/li>\n<li data-sourcepos=\"44:1-44:142\"><strong>So what actually shipped?<\/strong>\u00a0Erroneous behavior for uninitialized variables, a hardened standard library, contracts, and a new async model.<\/li>\n<li data-sourcepos=\"45:1-46:0\"><strong>What can you turn on for an existing codebase right now?<\/strong>\u00a0The first two. Both deliver real safety gains from a recompile alone, with no rewrites and no need to annotate your code by hand.<\/li>\n<\/ul>\n<p data-sourcepos=\"47:1-47:122\">There is a gap between what dominated the headlines and what actually made it into the standard. And that is where the real story that&#8217;s worth understanding is. Let&#8217;s unpack it.<\/p>\n<h2 data-sourcepos=\"49:1-49:46\">Why C++ safety became a hot topic this year<\/h2>\n<p data-sourcepos=\"51:1-51:112\">Memory safety used to be a topic for language-committee mailing lists, but now it is a line item in procurement.<\/p>\n<p data-sourcepos=\"53:1-53:808\">The shift was heavily influenced by regulations. In 2023, CISA, the NSA, the FBI, and international partners published\u00a0<a href=\"https:\/\/www.cisa.gov\/resources-tools\/resources\/case-memory-safe-roadmaps\">The Case for Memory Safe Roadmaps<\/a>, which named C and C++ as memory-unsafe and asked vendors to publish a plan. In June 2025, the NSA and CISA followed with a\u00a0<a href=\"https:\/\/media.defense.gov\/2025\/Jun\/23\/2003742198\/-1\/-1\/0\/CSI_MEMORY_SAFE_LANGUAGES_REDUCING_VULNERABILITIES_IN_MODERN_SOFTWARE_DEVELOPMENT.PDF\">joint guidance document<\/a>\u00a0on reducing memory-related vulnerabilities. The most widely cited expectation: by January 1, 2026, software makers who supply critical infrastructure should publish a memory-safe roadmap, meaning a written plan for how they will drive memory-safety bugs out of their existing products.<\/p>\n<p data-sourcepos=\"55:1-55:460\">Why? There is data to support it. For years, both Microsoft and Google have reported that roughly 70% of their serious security vulnerabilities are memory-safety bugs. Those are cases where a program reads or writes memory it should not: using a chunk of memory after it has been freed, running past the end of an array, or reading a variable that was never assigned a value. That number is why regulators singled out the languages rather than the programmers.<\/p>\n<p data-sourcepos=\"57:1-57:430\">Take note, however, that nobody is asking you to rewrite a million lines of C++ into Rust. The regulators know that is not realistic on any timeline that matters, which is why the ask is a\u00a0<em>roadmap<\/em>, not a rewrite. The committee has been arguing the same question inside the standard itself, in a paper titled, plainly,\u00a0<a href=\"https:\/\/www.open-std.org\/jtc1\/sc22\/wg21\/docs\/papers\/2026\/p3874r1.pdf\">Should C++ be a memory-safe language?<\/a>.<\/p>\n<p data-sourcepos=\"59:1-59:247\">For most teams, the honest expectation is incremental gains. Make the code you already have measurably safer without stopping the world. C++26 is the first standard that gives you real tools for that. They are just not the ones that made the news.<\/p>\n<div id=\"attachment_5060\" style=\"width: 1034px\" class=\"wp-caption alignnone\"><a href=\"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/roadmap-not-rewrite.png?ssl=1\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-5060\" data-attachment-id=\"5060\" data-permalink=\"https:\/\/www.wholetomato.com\/blog\/c26-memory-safety-what-actually-ships-for-existing-code\/roadmap-not-rewrite\/\" data-orig-file=\"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/roadmap-not-rewrite.png?fit=1672%2C941&amp;ssl=1\" data-orig-size=\"1672,941\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"roadmap-not-rewrite\" data-image-description=\"\" data-image-caption=\"&lt;p&gt;Regulators ask for a memory-safe roadmap, not a full rewrite. The realistic path keeps your existing C++ and hardens it in steps.&lt;\/p&gt;\n\" data-medium-file=\"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/roadmap-not-rewrite.png?fit=300%2C169&amp;ssl=1\" data-large-file=\"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/roadmap-not-rewrite.png?fit=1024%2C576&amp;ssl=1\" class=\"size-large wp-image-5060\" src=\"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/roadmap-not-rewrite.png?resize=1024%2C576&#038;ssl=1\" alt=\"Two-panel diagram contrasting a crossed-out full rewrite of C++ into Rust against a realistic path of recompiling, hardening the standard library, and publishing a memory-safe roadmap.\" width=\"1024\" height=\"576\" srcset=\"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/roadmap-not-rewrite.png?resize=1024%2C576&amp;ssl=1 1024w, https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/roadmap-not-rewrite.png?resize=300%2C169&amp;ssl=1 300w, https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/roadmap-not-rewrite.png?resize=768%2C432&amp;ssl=1 768w, https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/roadmap-not-rewrite.png?resize=1536%2C864&amp;ssl=1 1536w, https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/roadmap-not-rewrite.png?resize=360%2C203&amp;ssl=1 360w, https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/roadmap-not-rewrite.png?w=1672&amp;ssl=1 1672w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" data-recalc-dims=\"1\" \/><\/a><p id=\"caption-attachment-5060\" class=\"wp-caption-text\">Regulators ask for a memory-safe roadmap, not a full rewrite. The realistic path keeps your existing C++ and hardens it in steps.<\/p><\/div>\n<h2 data-sourcepos=\"63:1-63:42\">C++ profiles did not make the cut<\/h2>\n<p data-sourcepos=\"65:1-65:89\">We&#8217;re leading with the disappointment because it is what most of the internet gets wrong.<\/p>\n<p data-sourcepos=\"67:1-67:405\">When people say &#8220;C++ memory safety,&#8221; they usually mean\u00a0<strong>Profiles<\/strong>. A profile is a set of opt-in safety checks, grouped by category (bounds, lifetime, type), that a compiler can enforce across your whole codebase without you having to annotate every object by hand. It is the pragmatic, C++-flavored answer to Rust. You get to keep your code, switch on guardrails by category, and tighten them over time.<\/p>\n<p data-sourcepos=\"69:1-69:426\">Unfortunately (or fortunately, depending on where your beliefs lie), Profiles did not make C++26. Bjarne Stroustrup, who has long pushed for them, saw it coming. In a\u00a0<a href=\"https:\/\/devclass.com\/2025\/05\/09\/interview-bjarne-stroustrup-on-21st-century-c-ai-risks-and-why-the-language-is-hard-to-replace\/\">May 2025 interview<\/a>\u00a0he warned that the committee &#8220;got confused and did not guarantee that this would be in C++ 26.&#8221; He was right.<\/p>\n<p data-sourcepos=\"71:1-71:496\">When the standard was finalized at the March 2026 meeting, profiles were left out, as Herb Sutter&#8217;s\u00a0<a href=\"https:\/\/herbsutter.com\/2026\/03\/29\/c26-is-done-trip-report-march-2026-iso-c-standards-meeting-london-croydon-uk\/\">trip report<\/a>\u00a0confirms. The work now continues toward the next cycle. Stroustrup&#8217;s\u00a0<a href=\"https:\/\/www.open-std.org\/jtc1\/sc22\/wg21\/docs\/papers\/2026\/p3984r0.pdf\">type-safety profile paper (P3984)<\/a>\u00a0and a general profiles framework are both targeted at C++29, with no final ship date promised.<\/p>\n<p data-sourcepos=\"73:1-73:306\">The other proposal didn&#8217;t make it either.\u00a0<strong>Safe C++ (P3390)<\/strong>\u00a0was the Rust-style proposal: a borrow checker, lifetime annotations, and provable memory safety for code written in the new dialect. (A borrow checker is the compile-time system Rust uses to prove your code never touches memory it should not.)<\/p>\n<p data-sourcepos=\"75:1-75:269\">The committee weighed the two directions and picked profiles. Work on Safe C++ inside ISO was\u00a0<a href=\"https:\/\/www.infoworld.com\/article\/4065702\/safe-c-proposal-for-memory-safety-flames-out.html\">discontinued<\/a>. The vote settled 19 for profiles, 9 for Safe C++, and 11 for both.<\/p>\n<p data-sourcepos=\"77:1-77:240\">So the feature most likely to give you Rust-grade guarantees wasn&#8217;t accepted, and the borrow-checker alternative is off the table in ISO for now. If a blog told you C++26 shipped memory-safety profiles, you can treat that claim as outdated.<\/p>\n<div id=\"attachment_5058\" style=\"width: 1034px\" class=\"wp-caption alignnone\"><a href=\"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/two-roads.png?ssl=1\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-5058\" data-attachment-id=\"5058\" data-permalink=\"https:\/\/www.wholetomato.com\/blog\/c26-memory-safety-what-actually-ships-for-existing-code\/two-roads\/\" data-orig-file=\"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/two-roads.png?fit=1672%2C941&amp;ssl=1\" data-orig-size=\"1672,941\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"two-roads\" data-image-description=\"\" data-image-caption=\"&lt;p&gt;Two competing routes to memory safety. The committee chose Profiles over the Rust-style Safe C++, but neither made C++26.&lt;\/p&gt;\n\" data-medium-file=\"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/two-roads.png?fit=300%2C169&amp;ssl=1\" data-large-file=\"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/two-roads.png?fit=1024%2C576&amp;ssl=1\" class=\"size-large wp-image-5058\" src=\"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/two-roads.png?resize=1024%2C576&#038;ssl=1\" alt=\"Diagram of two memory-safety approaches branching from C++ safety: Profiles (opt-in category checks, no annotations) targeting C++29, and Safe C++ (borrow checker, lifetime annotations, new dialect) discontinued in ISO.\" width=\"1024\" height=\"576\" srcset=\"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/two-roads.png?resize=1024%2C576&amp;ssl=1 1024w, https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/two-roads.png?resize=300%2C169&amp;ssl=1 300w, https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/two-roads.png?resize=768%2C432&amp;ssl=1 768w, https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/two-roads.png?resize=1536%2C864&amp;ssl=1 1536w, https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/two-roads.png?resize=360%2C203&amp;ssl=1 360w, https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/two-roads.png?w=1672&amp;ssl=1 1672w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" data-recalc-dims=\"1\" \/><\/a><p id=\"caption-attachment-5058\" class=\"wp-caption-text\">Two competing routes to memory safety. The committee chose Profiles over the Rust-style Safe C++, but neither made C++26.<\/p><\/div>\n<h2 data-sourcepos=\"81:1-81:52\">What did ship, and what it&#8217;s worth on real coding<\/h2>\n<p data-sourcepos=\"83:1-83:279\">Now the good news. It is quieter than the headlines, but far easier to adopt. (Reflection, C++26&#8217;s other marquee feature, has its own story for large codebases; we dug into\u00a0<a href=\"https:\/\/www.wholetomato.com\/blog\/cpp26-reflection-large-codebases\">what it actually changes<\/a>\u00a0separately.)<\/p>\n<h3 data-sourcepos=\"104:1-104:64\">The hardened standard library: the one thing you should know<\/h3>\n<p data-sourcepos=\"106:1-106:78\">If there is anything to integrate into your roadmap first, this should be it.<\/p>\n<p data-sourcepos=\"108:1-108:303\">C++26 standardizes a\u00a0<strong>hardened standard library<\/strong>\u00a0(proposal\u00a0<a href=\"https:\/\/github.com\/cplusplus\/papers\/issues\/2125\">P3471, &#8220;Standard Library Hardening&#8221;<\/a>). In plain terms, it adds opt-in safety checks to the most-used bounded operations:\u00a0<code>vector::operator[]<\/code>,\u00a0<code>span<\/code>,\u00a0<code>string<\/code>,\u00a0<code>string_view<\/code>, and dozens more.<\/p>\n<p data-sourcepos=\"110:1-110:234\">Where an out-of-bounds index (reaching for element 100 in a 10-element container) was once silent undefined behavior, a hardened build turns it into a checked violation that stops the program at runtime, before anything worse happens.<\/p>\n<div class=\"wp-block-codemirror-blocks code-block \">\n<pre class=\"CodeMirror\" data-setting=\"{&quot;mode&quot;:&quot;clike&quot;,&quot;mime&quot;:&quot;text\/x-c++src&quot;,&quot;theme&quot;:&quot;eclipse&quot;,&quot;lineNumbers&quot;:true,&quot;lineWrapping&quot;:false,&quot;styleActiveLine&quot;:true,&quot;readOnly&quot;:true,&quot;align&quot;:&quot;&quot;}\">std::vector&lt;int&gt; v = load();\r\nint x = v[i]; \/\/ today: silent UB if i is out of range\r\n\/\/ hardened: precondition check traps before the bad read<\/pre>\n<\/div>\n<p data-sourcepos=\"118:1-118:371\">The reason this is important is because of the field data. In Herb Sutter&#8217;s\u00a0<a href=\"https:\/\/herbsutter.com\/2026\/03\/29\/c26-is-done-trip-report-march-2026-iso-c-standards-meeting-london-croydon-uk\/\">March 2026 trip report<\/a>, Google&#8217;s production rollout of hardening fixed over 1,000 bugs, cut the segfault rate across their fleet by about 30%, and cost roughly 0.3% in performance.<\/p>\n<p data-sourcepos=\"120:1-120:287\">A segfault is a crash that happens when a program touches memory it is not allowed to touch, and the &#8220;segfault rate across the fleet&#8221; is simply how often those crashes happen across all of Google&#8217;s running machines. So a 30% cut means nearly a third fewer of those crashes in production.<\/p>\n<p data-sourcepos=\"122:1-122:177\">That last number, the 0.3%, is the one to sit with. Bounds checking has a reputation for being expensive, and here it measured as a rounding error against a 30% drop in crashes.<\/p>\n<p data-sourcepos=\"124:1-124:708\">For a Visual Studio team, there&#8217;s a catch: you have to explicitly turn it on. The standard does not dictate\u00a0<em>how<\/em> you enable hardening, so it arrives as compiler and build-system flags rather than one portable switch. MSVC has shipped bounds-check machinery for years through <a href=\"https:\/\/learn.microsoft.com\/en-us\/cpp\/standard-library\/iterator-debug-level\"><code>_ITERATOR_DEBUG_LEVEL<\/code><\/a>\u00a0and\u00a0<code>_CONTAINER_DEBUG_LEVEL<\/code>, and recent MSVC builds have begun implementing the C++26 hardening model. The exact flag story is still settling as of this writing, so confirm the current behavior in your VS 2026 toolset before you promise anything to a security team. But the direction is set, and partial support is already here.<\/p>\n<h3 data-sourcepos=\"85:1-85:49\">Uninitialized reads: from undefined to erroneous behavior<\/h3>\n<p data-sourcepos=\"91:1-91:243\">This one targets a specific, old bug class: <strong>use before set<\/strong>, reading a local variable before you&#8217;ve assigned it a value.<\/p>\n<div class=\"wp-block-codemirror-blocks code-block\">\n<pre class=\"CodeMirror\" data-setting=\"{&quot;mode&quot;:&quot;clike&quot;,&quot;mime&quot;:&quot;text\/x-c++src&quot;,&quot;theme&quot;:&quot;eclipse&quot;,&quot;lineNumbers&quot;:true,&quot;lineWrapping&quot;:false,&quot;styleActiveLine&quot;:true,&quot;readOnly&quot;:true,&quot;align&quot;:&quot;&quot;}\">int scale(bool ready) {\r\n\u00a0\u00a0\u00a0\u00a0int\u00a0factor;\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/\u00a0declared,\u00a0never\u00a0initialized\r\n\u00a0\u00a0\u00a0\u00a0if\u00a0(ready)\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0factor\u00a0=\u00a0compute();\r\n\u00a0\u00a0\u00a0\u00a0return\u00a0factor\u00a0*\u00a02;\u00a0\u00a0\u00a0\u00a0\u00a0\/\/\u00a0if\u00a0ready\u00a0==\u00a0false,\u00a0factor\u00a0was\u00a0never\u00a0set\r\n}<\/pre>\n<\/div>\n<p>To see what actually changed, you have to look at how a compiler <em>optimizes<\/em>. Optimization is the compiler rewriting your code to run faster while keeping the result the same, and to do that it has to make assumptions. The key assumption here is <strong>undefined behavior is treated as impossible.<\/strong> Before C++26, reading <code>factor<\/code> uninitialized was undefined behavior, so the compiler was entitled to assume that read never happens and rewrite the surrounding code on that basis.<\/p>\n<p>The clearest example is an uninitialized <code>bool<\/code>:<\/p>\n<div class=\"wp-block-codemirror-blocks code-block\">\n<pre class=\"CodeMirror\" data-setting=\"{&quot;mode&quot;:&quot;clike&quot;,&quot;mime&quot;:&quot;text\/x-c++src&quot;,&quot;theme&quot;:&quot;eclipse&quot;,&quot;lineNumbers&quot;:true,&quot;lineWrapping&quot;:false,&quot;styleActiveLine&quot;:true,&quot;readOnly&quot;:true,&quot;align&quot;:&quot;&quot;}\">bool b;\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ uninitialized\r\nif (b)\u00a0\u00a0foo();\r\nif (!b) bar();\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ UB: the compiler may legally call both, or neither<\/pre>\n<\/div>\n<p>Because reading <code>b<\/code> is undefined behavior, the compiler doesn&#8217;t have to consider &#8220;what if it&#8217;s garbage.&#8221; It can assume <code>b<\/code> holds one consistent value and optimize the branches accordingly (nothing in the standard said it couldn&#8217;t). Mainstream compilers rarely do the most destructive version of this in practice, but that restraint was a convention, not a rule.<\/p>\n<p>C++26 now makes it a rule. Reading an uninitialized local is now <strong>erroneous behavior<\/strong> (proposal <a href=\"https:\/\/www.open-std.org\/jtc1\/sc22\/wg21\/docs\/papers\/2024\/p2795r5.html\" target=\"_blank\" rel=\"noopener noreferrer\">P2795<\/a>), a defined category that sits between &#8220;correct&#8221; and &#8220;anything goes&#8221;:<\/p>\n<ul>\n<li>The variable holds a\u00a0<strong>fixed, specified value<\/strong>\u00a0(implementations fill it with a set pattern), not whatever was left on the stack.<\/li>\n<li>Reading it is still wrong, and the compiler is encouraged to diagnose it. A hardened or sanitized build can trap on it.<\/li>\n<li>But it is\u00a0<strong>bounded and reproducible<\/strong>. The compiler can no longer treat the read as impossible and rewrite around it. Same input, same result, every run.<\/li>\n<\/ul>\n<p>It does not fix your logic: <code>factor<\/code> still isn&#8217;t the correct number. What changes is what that mistake is <em>allowed to become<\/em>.<\/p>\n<p>If you actually want an uninitialized value (like a performance-critical buffer you fill yourself), you opt out per variable with <code>[[indeterminate]]<\/code>, so the intent is visible in the code instead of hidden in an accident.<\/p>\n<p>The payoff for a large codebase: recompiling as C++26 removes this undefined-behavior class everywhere at once, with no source changes. It won&#8217;t clear your bug tracker, but it turns a whole family of &#8220;used before it was set&#8221; hazards from nondeterministic <em>landmines<\/em> into deterministic, diagnosable bugs.<\/p>\n<h3 data-sourcepos=\"126:1-126:46\">Contracts and the new async model, briefly<\/h3>\n<p data-sourcepos=\"128:1-128:65\">Two more features touch on safety without being the center of it.<\/p>\n<p data-sourcepos=\"130:1-130:314\"><strong>Contracts<\/strong>\u00a0arrived in C++26. You now get real language-level preconditions, postconditions, and a\u00a0<code>contract_assert<\/code>\u00a0statement, with four enforcement modes you can switch between at build time. (A precondition is a promise about what must be true when a function is called, and the runtime can check it for you.)<\/p>\n<div class=\"wp-block-codemirror-blocks code-block \">\n<pre class=\"CodeMirror\" data-setting=\"{&quot;mode&quot;:&quot;clike&quot;,&quot;mime&quot;:&quot;text\/x-c++src&quot;,&quot;theme&quot;:&quot;eclipse&quot;,&quot;lineNumbers&quot;:true,&quot;lineWrapping&quot;:false,&quot;styleActiveLine&quot;:true,&quot;readOnly&quot;:true,&quot;align&quot;:&quot;&quot;}\">int scale(int value, int factor)\r\n\u00a0\u00a0\u00a0\u00a0pre(factor\u00a0&gt;\u00a00)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/\u00a0precondition:\u00a0checked\u00a0on\u00a0entry\r\n\u00a0\u00a0\u00a0\u00a0post(result:\u00a0result\u00a0&gt;=\u00a0value)\u00a0\u00a0\u00a0\/\/\u00a0postcondition:\u00a0checked\u00a0on\u00a0return\r\n{\r\n\u00a0\u00a0\u00a0\u00a0contract_assert(value\u00a0&gt;=\u00a00);\u00a0\u00a0\u00a0\u00a0\/\/\u00a0checked\u00a0mid-body\r\n\u00a0\u00a0\u00a0\u00a0return\u00a0value\u00a0*\u00a0factor;\r\n}<\/pre>\n<\/div>\n<p data-sourcepos=\"132:1-132:422\">Those four modes (ignore, observe, enforce, quick-enforce) let you decide at build time whether a failed check is skipped, logged, or trapped, so you can run enforced in testing and revert in release.<\/p>\n<p data-sourcepos=\"132:1-132:422\">They are genuinely useful for encoding the assumptions your interfaces already depend on. Just be careful calling them a memory-safety feature. Their\u00a0<a href=\"https:\/\/www.theregister.com\/2026\/03\/31\/cplusplus26_approved\/\">safety value was disputed inside the committee<\/a>\u00a0right up to the final vote, and a precondition is only as good as the one you remembered to write. Treat contracts as better defensive checks, not as guarantees.<\/p>\n<p data-sourcepos=\"134:1-134:365\"><strong>std::execution<\/strong>\u00a0(senders and receivers) gives C++ a built-in model for\u00a0<em>structured concurrency<\/em>: a disciplined way to organize work that runs in parallel. It is designed to make data races much easier to avoid. (A data race is two threads touching the same memory at once, with at least one writing and no coordination between them, which is undefined behavior.)<\/p>\n<p data-sourcepos=\"136:1-136:400\">It will not make concurrent code automatically race-free, since you can still share mutable state and get into trouble, but it gives you a framework built to steer around those mistakes. It is a significant addition. It is also heavy, it wants helper libraries today, and adopting it in an existing codebase is a multi-year project. Worth knowing about, but not part of your next-quarter safety plan.<\/p>\n<h2 data-sourcepos=\"138:1-138:48\">What a large-codebase team should actually do<\/h2>\n<p data-sourcepos=\"140:1-140:93\">Here is the roadmap you can paste into a security questionnaire, in order of required effort.<\/p>\n<p data-sourcepos=\"142:1-142:370\"><strong>Turn on the easy wins.<\/strong>\u00a0Recompile as C++26 wherever your toolchain allows it, and you inherit erroneous behavior for uninitialized locals with zero code changes. Enable the hardened standard library in a staging build, measure the overhead against your real workload, and promote it to your production configuration if the cost is as low for you as it was for Google.<\/p>\n<p data-sourcepos=\"144:1-144:288\"><strong>Harden the interfaces you already touch.<\/strong>\u00a0As you work in a module, add contracts to the functions you are already modifying. It&#8217;s incremental by design. You are not stopping feature work to annotate the whole codebase; you are just reinforcing the parts that are already in your hands.<\/p>\n<p data-sourcepos=\"146:1-146:477\"><strong>Write the roadmap the regulators actually asked for.<\/strong>\u00a0The honest answer to the security questionnaire is not &#8220;we&#8217;re memory-safe now,&#8221; and it is not &#8220;nothing until C++29.&#8221; The better, more nuanced answer would be something along the lines of &#8220;We have enabled recompile-level hardening and the hardened standard library, we are adding contracts incrementally, and we are tracking profiles for the next standard.&#8221; That signals action, which is what the guidance was asking for.<\/p>\n<p data-sourcepos=\"148:1-148:495\">There is a requirement nobody puts on the slide, though. You cannot harden what you cannot find. Enabling bounds checking is a flag; deciding\u00a0<em>where<\/em>\u00a0it matters means locating every risky access across the codebase. It is the\u00a0<code>operator[]<\/code>\u00a0on data that came from a file or a socket. Or the raw pointer arithmetic in the old subsystem nobody wants to touch. Or the unchecked index sitting one line away from a container you just hardened. On a million-line codebase, that audit is the actual work.<\/p>\n<div id=\"attachment_5059\" style=\"width: 1034px\" class=\"wp-caption alignnone\"><a href=\"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/adoption-roadmap.png?ssl=1\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-5059\" data-attachment-id=\"5059\" data-permalink=\"https:\/\/www.wholetomato.com\/blog\/c26-memory-safety-what-actually-ships-for-existing-code\/adoption-roadmap\/\" data-orig-file=\"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/adoption-roadmap.png?fit=1672%2C941&amp;ssl=1\" data-orig-size=\"1672,941\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"adoption-roadmap\" data-image-description=\"\" data-image-caption=\"&lt;p&gt;A practical adoption order: the free recompile-level wins first, hardened standard library next, contracts and profile-tracking as ongoing work.&lt;\/p&gt;\n\" data-medium-file=\"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/adoption-roadmap.png?fit=300%2C169&amp;ssl=1\" data-large-file=\"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/adoption-roadmap.png?fit=1024%2C576&amp;ssl=1\" class=\"size-large wp-image-5059\" src=\"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/adoption-roadmap.png?resize=1024%2C576&#038;ssl=1\" alt=\"Three-step adoption roadmap: recompile as C++26 for erroneous-behavior wins, enable the hardened standard library in staging then promote it, and add contracts while tracking C++29 profiles, ordered by increasing effort.\" width=\"1024\" height=\"576\" srcset=\"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/adoption-roadmap.png?resize=1024%2C576&amp;ssl=1 1024w, https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/adoption-roadmap.png?resize=300%2C169&amp;ssl=1 300w, https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/adoption-roadmap.png?resize=768%2C432&amp;ssl=1 768w, https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/adoption-roadmap.png?resize=1536%2C864&amp;ssl=1 1536w, https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/adoption-roadmap.png?resize=360%2C203&amp;ssl=1 360w, https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/adoption-roadmap.png?w=1672&amp;ssl=1 1672w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" data-recalc-dims=\"1\" \/><\/a><p id=\"caption-attachment-5059\" class=\"wp-caption-text\">A practical adoption order: the free recompile-level wins first, hardened standard library next, contracts and profile-tracking as ongoing work.<\/p><\/div>\n<h2 data-sourcepos=\"152:1-152:41\">Finding the risk before you can fix it<\/h2>\n<p data-sourcepos=\"154:1-154:461\">The audit is a code-comprehension problem before it is a safety problem. Before you can decide which of ten thousand indexing operations sit on an untrusted path, you have to find and detect them. Which means you need to\u00a0<a href=\"https:\/\/www.wholetomato.com\/blog\/navigate-large-legacy-cpp-codebase\/\">find every reference to a symbol across the whole solution<\/a>, jump to each call site, and understand the data flowing around it without losing an afternoon to the search.<\/p>\n<p data-sourcepos=\"156:1-156:370\">Fast, accurate navigation is what turns a codebase-wide safety audit from a month into a week, and that is exactly the comprehension work that C++ Visual Studio plugins like\u00a0<a href=\"https:\/\/www.wholetomato.com\/downloads\">Visual Assist<\/a>\u00a0are built for. It will not make your code memory-safe (no tool does that for you), but it makes the audit that has to happen first tractable.<\/p>\n<h2 data-sourcepos=\"158:1-158:42\">The features that ship should be boring<\/h2>\n<p data-sourcepos=\"160:1-160:440\">The security team&#8217;s questionnaire does not have a good one-word answer, and that is fine. C++26&#8217;s real memory-safety story was never the profiles that made the headlines and then slipped a cycle. It is the unglamorous, recompile-level hardening that a real team can actually adopt without betting a release on it: uninitialized reads defanged, the standard library checkable, contracts where you want them, and a credible plan for the rest.<\/p>\n<p data-sourcepos=\"162:1-162:190\">The rewrite fantasy is, for now, still a fantasy. Incremental hardening is here, and it&#8217;s an action step you can take this quarter. Sometimes the boring feature is the one that matters most.<\/p>\n<p style=\"text-align: center;\" data-sourcepos=\"162:1-162:190\"><div class=\"actions\">\r\n\t<a href=\"https:\/\/www.wholetomato.com\/downloads?utm_content=blog-\" class=\"button primary\">Try Visual Assist<\/a>\r\n<\/div>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Search for &#8220;C++26 memory safety&#8221; and the results won&#8217;t agree with each other. One post declares C++ finally memory-safe. The next, titled something like &#8220;C++26 memory features won&#8217;t save you,&#8221; says nothing important changed. In&#8230;<\/p>\n","protected":false},"author":213500340,"featured_media":5057,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_newsletter_tier_id":0,"footnotes":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[672],"tags":[726360666,726360662,726360711,726360709,726360523,6678],"class_list":["post-5055","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tips-and-tricks","tag-c-language-features","tag-c26","tag-contracts","tag-hardened-standard-library","tag-memory-safety","tag-visual-studio"],"jetpack_publicize_connections":[],"aioseo_notices":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/cover.png?fit=1672%2C941&ssl=1","jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pfpLS4-1jx","aioseo_head":"\n\t\t<!-- All in One SEO Pro 4.9.7.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"C++26&#039;s safety Profiles slipped to C++29. Here&#039;s what actually shipped for memory safety, and what a large MSVC C++ codebase can turn on right now.\" \/>\n\t<meta name=\"robots\" content=\"max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n\t<meta name=\"author\" content=\"Tristan Soliven\"\/>\n\t<meta name=\"google-site-verification\" content=\"DtHrwoEjg0KG_fbuPSp5j_wNIf-g5hSh4EH6tZBoCIw\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.wholetomato.com\/blog\/cpp26-memory-safety-existing-code\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 4.9.7.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Tomato Soup - Visual Assist Team Blog\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"C++26 Memory Safety: What Ships for Existing Code - July 2026\" \/>\n\t\t<meta property=\"og:description\" content=\"C++26&#039;s safety Profiles slipped to C++29. Here&#039;s what actually shipped for memory safety, and what a large MSVC C++ codebase can turn on right now.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.wholetomato.com\/blog\/cpp26-memory-safety-existing-code\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-07-26T16:05:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-07-26T16:08:10+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/wholetomatosoftware\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@visualassist\" \/>\n\t\t<meta name=\"twitter:title\" content=\"C++26 Memory Safety: What Ships for Existing Code - July 2026\" \/>\n\t\t<meta name=\"twitter:description\" content=\"C++26&#039;s safety Profiles slipped to C++29. Here&#039;s what actually shipped for memory safety, and what a large MSVC C++ codebase can turn on right now.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@visualassist\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/c26-memory-safety-what-actually-ships-for-existing-code\\\/#blogposting\",\"name\":\"C++26 Memory Safety: What Ships for Existing Code - July 2026\",\"headline\":\"C++26 Memory Safety: What Actually Ships for Existing Code\",\"author\":{\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/author\\\/tristansoliven\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/www.wholetomato.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/cover.png?fit=1672%2C941&ssl=1\",\"width\":1672,\"height\":941,\"caption\":\"Schematic shield built from C++ code lines, with hardened standard library, uninitialized-to-erroneous-behavior, and contracts shown as active nodes, and safety profiles shown separate and deferred to C++29.\"},\"datePublished\":\"2026-07-26T12:05:34-04:00\",\"dateModified\":\"2026-07-26T12:08:10-04:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/c26-memory-safety-what-actually-ships-for-existing-code\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/c26-memory-safety-what-actually-ships-for-existing-code\\\/#webpage\"},\"articleSection\":\"Tips and Tricks, C++ language features, C++26, contracts, hardened standard library, memory safety, Visual Studio, English\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/c26-memory-safety-what-actually-ships-for-existing-code\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/category\\\/tips-and-tricks\\\/#listItem\",\"name\":\"Tips and Tricks\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/category\\\/tips-and-tricks\\\/#listItem\",\"position\":2,\"name\":\"Tips and Tricks\",\"item\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/category\\\/tips-and-tricks\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/c26-memory-safety-what-actually-ships-for-existing-code\\\/#listItem\",\"name\":\"C++26 Memory Safety: What Actually Ships for Existing Code\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/c26-memory-safety-what-actually-ships-for-existing-code\\\/#listItem\",\"position\":3,\"name\":\"C++26 Memory Safety: What Actually Ships for Existing Code\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/category\\\/tips-and-tricks\\\/#listItem\",\"name\":\"Tips and Tricks\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/#organization\",\"name\":\"Tomato Soup\",\"description\":\"Visual Assist Team Blog\",\"url\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/\",\"email\":\"info@wholetomato.com\",\"numberOfEmployees\":{\"@type\":\"QuantitativeValue\",\"minValue\":0,\"maxValue\":100},\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/www.wholetomato.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/WT_symbol.png?fit=112%2C112&ssl=1\",\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/c26-memory-safety-what-actually-ships-for-existing-code\\\/#organizationLogo\",\"width\":112,\"height\":112,\"caption\":\"visual assist main tomato symbol icon\"},\"image\":{\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/c26-memory-safety-what-actually-ships-for-existing-code\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/wholetomatosoftware\",\"https:\\\/\\\/twitter.com\\\/visualassist\",\"https:\\\/\\\/www.youtube.com\\\/c\\\/Wholetomatosoftware\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/whole-tomato-software\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/author\\\/tristansoliven\\\/#author\",\"url\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/author\\\/tristansoliven\\\/\",\"name\":\"Tristan Soliven\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/c26-memory-safety-what-actually-ships-for-existing-code\\\/#webpage\",\"url\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/c26-memory-safety-what-actually-ships-for-existing-code\\\/\",\"name\":\"C++26 Memory Safety: What Ships for Existing Code - July 2026\",\"description\":\"C++26's safety Profiles slipped to C++29. Here's what actually shipped for memory safety, and what a large MSVC C++ codebase can turn on right now.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/c26-memory-safety-what-actually-ships-for-existing-code\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/author\\\/tristansoliven\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/author\\\/tristansoliven\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/www.wholetomato.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/cover.png?fit=1672%2C941&ssl=1\",\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/c26-memory-safety-what-actually-ships-for-existing-code\\\/#mainImage\",\"width\":1672,\"height\":941,\"caption\":\"Schematic shield built from C++ code lines, with hardened standard library, uninitialized-to-erroneous-behavior, and contracts shown as active nodes, and safety profiles shown separate and deferred to C++29.\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/c26-memory-safety-what-actually-ships-for-existing-code\\\/#mainImage\"},\"datePublished\":\"2026-07-26T12:05:34-04:00\",\"dateModified\":\"2026-07-26T12:08:10-04:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/\",\"name\":\"Tomato Soup\",\"description\":\"Visual Assist Team Blog\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.wholetomato.com\\\/blog\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>C++26 Memory Safety: What Ships for Existing Code - July 2026<\/title>\n\n","aioseo_head_json":{"title":"C++26 Memory Safety: What Ships for Existing Code - July 2026","description":"C++26's safety Profiles slipped to C++29. Here's what actually shipped for memory safety, and what a large MSVC C++ codebase can turn on right now.","canonical_url":"https:\/\/www.wholetomato.com\/blog\/cpp26-memory-safety-existing-code","robots":"max-snippet:-1, max-image-preview:large, max-video-preview:-1","keywords":"","webmasterTools":{"google-site-verification":"DtHrwoEjg0KG_fbuPSp5j_wNIf-g5hSh4EH6tZBoCIw","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/www.wholetomato.com\/blog\/c26-memory-safety-what-actually-ships-for-existing-code\/#blogposting","name":"C++26 Memory Safety: What Ships for Existing Code - July 2026","headline":"C++26 Memory Safety: What Actually Ships for Existing Code","author":{"@id":"https:\/\/www.wholetomato.com\/blog\/author\/tristansoliven\/#author"},"publisher":{"@id":"https:\/\/www.wholetomato.com\/blog\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/cover.png?fit=1672%2C941&ssl=1","width":1672,"height":941,"caption":"Schematic shield built from C++ code lines, with hardened standard library, uninitialized-to-erroneous-behavior, and contracts shown as active nodes, and safety profiles shown separate and deferred to C++29."},"datePublished":"2026-07-26T12:05:34-04:00","dateModified":"2026-07-26T12:08:10-04:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.wholetomato.com\/blog\/c26-memory-safety-what-actually-ships-for-existing-code\/#webpage"},"isPartOf":{"@id":"https:\/\/www.wholetomato.com\/blog\/c26-memory-safety-what-actually-ships-for-existing-code\/#webpage"},"articleSection":"Tips and Tricks, C++ language features, C++26, contracts, hardened standard library, memory safety, Visual Studio, English"},{"@type":"BreadcrumbList","@id":"https:\/\/www.wholetomato.com\/blog\/c26-memory-safety-what-actually-ships-for-existing-code\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.wholetomato.com\/blog#listItem","position":1,"name":"Home","item":"https:\/\/www.wholetomato.com\/blog","nextItem":{"@type":"ListItem","@id":"https:\/\/www.wholetomato.com\/blog\/category\/tips-and-tricks\/#listItem","name":"Tips and Tricks"}},{"@type":"ListItem","@id":"https:\/\/www.wholetomato.com\/blog\/category\/tips-and-tricks\/#listItem","position":2,"name":"Tips and Tricks","item":"https:\/\/www.wholetomato.com\/blog\/category\/tips-and-tricks\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.wholetomato.com\/blog\/c26-memory-safety-what-actually-ships-for-existing-code\/#listItem","name":"C++26 Memory Safety: What Actually Ships for Existing Code"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.wholetomato.com\/blog#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.wholetomato.com\/blog\/c26-memory-safety-what-actually-ships-for-existing-code\/#listItem","position":3,"name":"C++26 Memory Safety: What Actually Ships for Existing Code","previousItem":{"@type":"ListItem","@id":"https:\/\/www.wholetomato.com\/blog\/category\/tips-and-tricks\/#listItem","name":"Tips and Tricks"}}]},{"@type":"Organization","@id":"https:\/\/www.wholetomato.com\/blog\/#organization","name":"Tomato Soup","description":"Visual Assist Team Blog","url":"https:\/\/www.wholetomato.com\/blog\/","email":"info@wholetomato.com","numberOfEmployees":{"@type":"QuantitativeValue","minValue":0,"maxValue":100},"logo":{"@type":"ImageObject","url":"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/05\/WT_symbol.png?fit=112%2C112&ssl=1","@id":"https:\/\/www.wholetomato.com\/blog\/c26-memory-safety-what-actually-ships-for-existing-code\/#organizationLogo","width":112,"height":112,"caption":"visual assist main tomato symbol icon"},"image":{"@id":"https:\/\/www.wholetomato.com\/blog\/c26-memory-safety-what-actually-ships-for-existing-code\/#organizationLogo"},"sameAs":["https:\/\/www.facebook.com\/wholetomatosoftware","https:\/\/twitter.com\/visualassist","https:\/\/www.youtube.com\/c\/Wholetomatosoftware","https:\/\/www.linkedin.com\/company\/whole-tomato-software"]},{"@type":"Person","@id":"https:\/\/www.wholetomato.com\/blog\/author\/tristansoliven\/#author","url":"https:\/\/www.wholetomato.com\/blog\/author\/tristansoliven\/","name":"Tristan Soliven"},{"@type":"WebPage","@id":"https:\/\/www.wholetomato.com\/blog\/c26-memory-safety-what-actually-ships-for-existing-code\/#webpage","url":"https:\/\/www.wholetomato.com\/blog\/c26-memory-safety-what-actually-ships-for-existing-code\/","name":"C++26 Memory Safety: What Ships for Existing Code - July 2026","description":"C++26's safety Profiles slipped to C++29. Here's what actually shipped for memory safety, and what a large MSVC C++ codebase can turn on right now.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.wholetomato.com\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/www.wholetomato.com\/blog\/c26-memory-safety-what-actually-ships-for-existing-code\/#breadcrumblist"},"author":{"@id":"https:\/\/www.wholetomato.com\/blog\/author\/tristansoliven\/#author"},"creator":{"@id":"https:\/\/www.wholetomato.com\/blog\/author\/tristansoliven\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/i0.wp.com\/www.wholetomato.com\/blog\/wp-content\/uploads\/2026\/07\/cover.png?fit=1672%2C941&ssl=1","@id":"https:\/\/www.wholetomato.com\/blog\/c26-memory-safety-what-actually-ships-for-existing-code\/#mainImage","width":1672,"height":941,"caption":"Schematic shield built from C++ code lines, with hardened standard library, uninitialized-to-erroneous-behavior, and contracts shown as active nodes, and safety profiles shown separate and deferred to C++29."},"primaryImageOfPage":{"@id":"https:\/\/www.wholetomato.com\/blog\/c26-memory-safety-what-actually-ships-for-existing-code\/#mainImage"},"datePublished":"2026-07-26T12:05:34-04:00","dateModified":"2026-07-26T12:08:10-04:00"},{"@type":"WebSite","@id":"https:\/\/www.wholetomato.com\/blog\/#website","url":"https:\/\/www.wholetomato.com\/blog\/","name":"Tomato Soup","description":"Visual Assist Team Blog","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.wholetomato.com\/blog\/#organization"}}]},"og:locale":"en_US","og:site_name":"Tomato Soup - Visual Assist Team Blog","og:type":"article","og:title":"C++26 Memory Safety: What Ships for Existing Code - July 2026","og:description":"C++26's safety Profiles slipped to C++29. Here's what actually shipped for memory safety, and what a large MSVC C++ codebase can turn on right now.","og:url":"https:\/\/www.wholetomato.com\/blog\/cpp26-memory-safety-existing-code","article:published_time":"2026-07-26T16:05:34+00:00","article:modified_time":"2026-07-26T16:08:10+00:00","article:publisher":"https:\/\/www.facebook.com\/wholetomatosoftware","twitter:card":"summary_large_image","twitter:site":"@visualassist","twitter:title":"C++26 Memory Safety: What Ships for Existing Code - July 2026","twitter:description":"C++26's safety Profiles slipped to C++29. Here's what actually shipped for memory safety, and what a large MSVC C++ codebase can turn on right now.","twitter:creator":"@visualassist"},"aioseo_meta_data":{"post_id":"5055","title":"C++26 Memory Safety: What Ships for Existing Code #separator_sa #post_month #post_year","description":"C++26's safety Profiles slipped to C++29. Here's what actually shipped for memory safety, and what a large MSVC C++ codebase can turn on right now.","keywords":null,"keyphrases":{"focus":{"keyphrase":"C++26 memory safety","score":69,"analysis":{"keyphraseInTitle":{"score":9,"maxScore":9,"error":0},"keyphraseInDescription":{"score":3,"maxScore":9,"error":1},"keyphraseLength":{"score":9,"maxScore":9,"error":0,"length":3},"keyphraseInURL":{"score":5,"maxScore":5,"error":0},"keyphraseInIntroduction":{"score":9,"maxScore":9,"error":0},"keyphraseInSubHeadings":{"score":3,"maxScore":9,"error":1},"keyphraseInImageAlt":{"score":9,"maxScore":9,"error":0},"keywordDensity":{"score":0,"type":"low","maxScore":9,"error":1}}},"additional":[{"keyphrase":"C++26 safety profiles, C++26 hardened standard library, does C++26 have memory safety, C++26 vs Rust memory safety, erroneous behavior C++26","score":27,"analysis":{"keyphraseInDescription":{"score":3,"maxScore":9,"error":1},"keyphraseLength":{"score":3,"maxScore":9,"error":1,"length":20},"keyphraseInIntroduction":{"score":3,"maxScore":9,"error":1},"keyphraseInImageAlt":{"score":3,"maxScore":9,"error":1},"keywordDensity":{"score":0,"type":"low","maxScore":9,"error":1}}}]},"primary_term":null,"canonical_url":"https:\/\/www.wholetomato.com\/blog\/cpp26-memory-safety-existing-code","og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[{"schemaType":"FAQPage","schemaData":{"@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Did C++26 make memory safety the same as Rust?","acceptedAnswer":{"@type":"Answer","text":"No."}},{"@type":"Question","name":"Did the safety Profiles land in C++26?","acceptedAnswer":{"@type":"Answer","text":"No. They slipped to the next standard cycle and are currently targeted for C++29."}},{"@type":"Question","name":"What actually shipped in C++26?","acceptedAnswer":{"@type":"Answer","text":"Erroneous behavior for uninitialized variables, a hardened standard library, contracts, and a new async model."}},{"@type":"Question","name":"What can you turn on for an existing codebase right now?","acceptedAnswer":{"@type":"Answer","text":"The first two. Both deliver real safety gains from a recompile alone, with no rewrites and no need to annotate your code by hand."}}]},"confidence":78,"reasoning":"FAQPage was chosen to capture the page's key Q&A topics derived directly from the article content, providing structured answers that reflect the main points discussed (memory safety status, shipped features, and practical steps)."}],"titles":[],"descriptions":[],"socialPosts":{"email":[],"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-07-21 20:38:17","updated":"2026-07-26 16:26:11","reviewed_by":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.wholetomato.com\/blog\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.wholetomato.com\/blog\/category\/tips-and-tricks\/\" title=\"Tips and Tricks\">Tips and Tricks<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tC++26 Memory Safety: What Actually Ships for Existing Code\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.wholetomato.com\/blog"},{"label":"Tips and Tricks","link":"https:\/\/www.wholetomato.com\/blog\/category\/tips-and-tricks\/"},{"label":"C++26 Memory Safety: What Actually Ships for Existing Code","link":"https:\/\/www.wholetomato.com\/blog\/c26-memory-safety-what-actually-ships-for-existing-code\/"}],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.wholetomato.com\/blog\/wp-json\/wp\/v2\/posts\/5055","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wholetomato.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wholetomato.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wholetomato.com\/blog\/wp-json\/wp\/v2\/users\/213500340"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wholetomato.com\/blog\/wp-json\/wp\/v2\/comments?post=5055"}],"version-history":[{"count":10,"href":"https:\/\/www.wholetomato.com\/blog\/wp-json\/wp\/v2\/posts\/5055\/revisions"}],"predecessor-version":[{"id":5071,"href":"https:\/\/www.wholetomato.com\/blog\/wp-json\/wp\/v2\/posts\/5055\/revisions\/5071"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.wholetomato.com\/blog\/wp-json\/wp\/v2\/media\/5057"}],"wp:attachment":[{"href":"https:\/\/www.wholetomato.com\/blog\/wp-json\/wp\/v2\/media?parent=5055"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wholetomato.com\/blog\/wp-json\/wp\/v2\/categories?post=5055"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wholetomato.com\/blog\/wp-json\/wp\/v2\/tags?post=5055"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}