Memory Safety in Medical Devices: Understanding and Mitigating Critical Vulnerabilities

Cybersecurity for medical devices has become an increasing focus in recent years. As devices grow more complex and connected, the opportunities for successful attacks or breaches continue to rise. Embedded medical devices, in particular, must address the security of the software that enables them to operate.

In both the United States and the EU, new regulations require medical device manufacturers to consider cybersecurity throughout the entire device lifecycle—from design and development to post-market vulnerability management.

One critical, yet often overlooked, cybersecurity challenge in medical devices—especially legacy systems written in C/C++—is the prevalence of memory-based vulnerabilities. Memory safety is such a widespread issue that addressing it has become a key component of Secure by Design guidance from CISA in the United States, particularly for embedded devices.

How significant is the memory safety problem in medical devices, and how can software manufacturers address it?

Memory-based vulnerabilities pose a significant risk to embedded medical devices. These vulnerabilities occur when software improperly handles memory, potentially allowing attackers to disrupt or take control of normal device operations. The implications are serious: imagine an insulin pump delivering the wrong dosage or an MRI machine producing inaccurate results.

Legacy medical devices are especially vulnerable to memory safety issues. Their continued integration into modern healthcare environments creates potential entry points for attackers, putting patient care and critical services at risk.

In one example, Critical Software and RunSafe Security identified more than 2,000 vulnerabilities in a medical device company’s legacy equipment. A substantial portion of these vulnerabilities were memory safety-related and classified as high severity.

Medical device manufacturers can take several steps to mitigate memory safety vulnerabilities:

• Implement a secure development lifecycle aligned with Secure by Design principles

• Use Software Bill of Materials (SBOMs) to improve vulnerability visibility

• Rewrite code in memory-safe programming languages

• Deploy proactive security solutions designed to mitigate memory safety risks

Because securing medical devices must extend across the entire lifecycle—including post-market phases—proactive solutions such as Runtime Application Self-Protection (RASP) can prevent attackers from exploiting memory vulnerabilities even before patches are available.

RASP solutions enable deployed software to defend itself by mitigating memory-based vulnerabilities as they arise. This reduces the need for constant patching, minimizes operational disruption, and protects devices between software updates.

In the earlier example, the medical device company evaluated the impact of applying RunSafe’s memory protection solution for embedded systems and found that:

• 44% of vulnerabilities were immediately mitigated

• 71% of the most critical vulnerabilities were mitigated

• 100% of runtime-exploitable memory safety vulnerabilities were mitigated

As the medical device software supply chain becomes more complex, memory safety will remain a critical priority. By adopting proactive and comprehensive security strategies, manufacturers can better protect patient safety and ensure device reliability.

• Prioritize memory safety as a core security concern

• Integrate security testing throughout the development lifecycle

• Consider advanced mitigation technologies

• Maintain transparency around potential vulnerabilities

• Plan for continuous security management across the device lifecycle

The future of medical device cybersecurity lies not only in identifying vulnerabilities but also in building adaptive protection mechanisms capable of anticipating and neutralizing threats before they cause harm.