We can resolve this empirically, by looking at the list of glibc CVEs: <a href="https:&#x2F;&#x2F;www.cvedetails.com&#x2F;vulnerability-list&#x2F;vendor_id-72&#x2F;product_id-767&#x2F;GNU-Glibc.html" rel="nofollow">https:&#x2F;&#x2F;www.cvedetails.com&#x2F;vulnerability-list&#x2F;vendor_id-72&#x2F;p...</a><p>The vast majority of the memory safety issues here are not at the public interface boundaries.