Compiler Can Undo Your Security Checks
Security researcher Chris Domas explains how compiler optimizations can inadvertently introduce security vulnerabilities into otherwise secure C code. The discussion covers the risks of automated code transformation and provides recommendations for developers to mitigate these issues.
Why it matters
It underscores a critical blind spot in software security where the final binary may not reflect the intent of the original source code.
Big thanks to @ThreatLocker for sponsoring my trip to Black Hat USA 2026 and also for sponsoring this video. To start your free trial with ThreatLocker please use the following link: https://www.threatlocker.com/davidbombal
You can write secure C code, follow accepted best practices and still end up with a vulnerable binary. The reason is simple: the CPU does not run your source code. It runs whatever the compiler produces.
David sits down with security researcher Chris Domas at Black Hat to examine how legal compiler optimizations can remove security protections, delete memory-clearing operations and introduce time-of-check to time-of-use vulnerabilities into code that appeared secure.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in