That&#x27;s what I meant - if you go through actual allocators, then of course such bug can exist. As you say &lt;&lt;the needed feature to mitigate this specific vulnerability is &quot;throws exception on malloc failure&quot;&gt;&gt;. But it seems to me like any language providing resizable buffers with bound checking in standard library is unlikely to get code like this in the first place. And that&#x27;s a massive scope reduction.