Overview
ISO/IEC TR 24772-1:2019 - Programming languages - Guidance to avoiding vulnerabilities in programming languages - Part 1: Language‑independent guidance - is a technical report from ISO that identifies programming‑language vulnerabilities that should be avoided when developing systems requiring assured behaviour (security, safety, mission‑critical, business‑critical). It provides language‑independent descriptions of common vulnerability patterns and avoidance mechanisms that are applicable across many programming languages. The document is focused on vulnerabilities themselves and explicitly does not address software engineering management, process improvement, or the specification of properties to be assured.
Key topics and technical coverage
The standard organizes guidance into practical, technical topics including:
- Predictable execution and sources of unpredictability:
- Incomplete or evolving language specifications
- Undefined, unspecified, and implementation‑defined behaviour
- Difficult language features and inadequate language support
- Sources of unpredictability in language usage:
- Porting and interoperation issues
- Compiler selection and configuration
- Top avoidance mechanisms for reducing vulnerability exposure
- A catalogue of specific programming language vulnerabilities (described generically), for example:
- Type system weaknesses
- Bit representation ambiguities
- Floating‑point arithmetic pitfalls
- Enumerator and conversion errors
- String termination and buffer boundary violations (buffer overflows)
- Unchecked array indexing / copying
- Pointer type conversions, pointer arithmetic, null pointer dereference
- Dangling references (heap)
For each vulnerability the report describes the application vulnerability, mechanism of failure, applicable language characteristics, avoidance or mitigation techniques, and implications for language design and evolution.
Practical applications
ISO/IEC TR 24772-1:2019 is practical for organizations and practitioners aiming to reduce language‑level vulnerabilities and improve software assurance:
- Integrate into secure coding guidelines and code review checklists
- Inform static analysis and testing focus areas (e.g., buffer overflows, null dereferences)
- Guide language selection, compiler configuration, and interoperability decisions for safety‑critical projects
- Support language designers and standards bodies by identifying features that increase risk
Who should use this standard
- Software developers and architects working on security or safety‑critical systems
- Code reviewers, QA engineers, and security auditors
- Language designers and tool vendors (compilers, static analyzers)
- Systems integrators and maintainers responsible for cross‑platform portability
Related standards
- This part is language‑independent; other parts of the ISO/IEC 24772 series provide language‑specific descriptions and mappings for particular programming languages. Use this report together with language‑specific parts to apply concrete mitigations.
Keywords: ISO/IEC TR 24772-1:2019, programming language vulnerabilities, language-independent guidance, secure coding, undefined behaviour, buffer overflow, safety-critical software.