The massive codebase forming the foundation of Windows has been built over decades through the accumulation of C and C++. In exchange for low-level control capabilities that push hardware performance to its limits, development teams have been continuously occupied with fixing vulnerabilities arising from inadequate memory management. From the OS kernel to office suites, invalid pointer dereferences and buffer overflows have created an endless cycle of discovery and remediation.
In September 2026, at the annual RustConf 2026 technical conference held in Montreal, Canada, Microsoft announced that it had added Rust to "Tier 1," its top internal development language category. This decision elevates a language that had previously been limited to experimental adoption or use in certain cloud infrastructure services to the same level of support as the company's flagship languages: C++, C#, and TypeScript.
This announcement is not the kind of change that immediately alters consumer-facing product specifications or sweeps away existing C++ code. Rather, it represents a shift in infrastructure operations—formalizing the support system that the massive internal development organization uses to build software, spanning everything from development environment setup to security compliance verification. To address the long-standing challenge of ensuring memory safety, the company has chosen the painstaking engineering solution of compiler infrastructure integration.
Defining the Internal "Tier 1" Standard and Overhauling Engineering Support
Victor Ciura, a principal engineer in Microsoft's Rust tooling division, took the stage at the RustConf 2026 keynote and revealed that Rust's status within the company had been clearly elevated. Ciura stated during his talk that Rust is now a Tier 1 language at Microsoft, joining the ranks of languages that receive the most comprehensive support in internal development. Coinciding with this announcement, a contribution from Ciura was also published on the official blog of the nonprofit Rust Foundation, dated September 10, 2026.
Microsoft has long been involved in the Rust ecosystem as a founding platinum member of the Rust Foundation. However, the elevation of Rust's status within the internal development organization to the highest tier represents company-wide backing that goes beyond voluntary adoption by individual development teams. What Ciura described as a "paved path" refers to a comprehensive support network covering the entire software development lifecycle—from writing code in local environments to deployment in production and ongoing maintenance.
This support system includes secure internal distribution of verified compiler toolchains, provision of editors and debuggers that enhance development productivity, and standardization of quality control workflows. In addition, compliance with Microsoft's company-wide mandatory Security Development Lifecycle (SDL) is now a requirement. When internal engineers choose Rust, they no longer need to seek individual exceptions for compliance reviews or build pipeline construction.
However, this designation defines Microsoft's internal engineering support policy and is not an external announcement of specification changes to the company's commercial products. Nor does it signal the deprecation of C++ or C#; rather, it represents an expansion of the development framework premised on coexistence with existing languages.
The Proprietary "rustc_codegen_utc" Backend: Integrating with the MSVC Toolchain
At the technical core of the internal Tier 1 promotion is "rustc_codegen_utc," a proprietary Rust compiler backend developed by Microsoft. The official Rust compiler, rustc, is designed with a loosely coupled architecture separating the frontend—which handles common parsing, semantic analysis, and intermediate representation generation—from the backend, which outputs machine code for each target environment. While LLVM (Low Level Virtual Machine) is used as the standard backend, the community has also pursued research into alternative backends, such as rustc_codegen_gcc, which uses GCC, and rustc_codegen_cranelift, aimed at fast compilation.
rustc_codegen_utc leverages this backend mechanism to directly connect rustc to "UTC," the internal compiler infrastructure of Microsoft Visual C++ (MSVC). The design repurposes the code generation engine of MSVC—a platform with decades of proven track record for generating native binaries for Windows—for Rust compilation as well.
In his contribution, Ciura emphasized the advantages this architecture provides. By connecting rustc to this backend, he explained, Rust can build on the same platform investment as C++ from the outset, maintaining compatibility without requiring parallel implementations for every Windows-specific feature. The result, he said, is a unified code generation platform for both Rust and C++ on Windows.
The purpose of this integrated infrastructure lies in achieving full compliance with the Windows-specific ABI (Application Binary Interface) and inheriting the binary protection technologies accumulated within the Windows environment. This includes security mechanisms that ensure address space layout randomization and control-flow integrity, post-link analysis and compliance verification, and compatibility with Hotpatch functionality, which applies fixes while a system is running.
| rustc Backend | Code Generation Target | Positioning and Characteristics (Based on Ciura's Contribution and Technical Reporting) |
|---|---|---|
| rustc_codegen_llvm | Machine code via LLVM intermediate representation | Official standard backend. Supports a broad range of architectures with mature optimization. |
| rustc_codegen_utc | MSVC internal compiler infrastructure (UTC) | Developed independently by Microsoft. Directly integrates with the Windows ABI, toolchain, and Hotpatch functionality. |
| rustc_codegen_gcc | Machine code via GCC's libgccjit | Aims for integration with the GNU toolchain. Leverages GCC's extensive assets for embedded CPU targets. |
| rustc_codegen_cranelift | Machine code via Cranelift intermediate representation | Specialized for fast code generation. Research is advancing for reducing build times during development and for JIT execution environments. |
According to internal data disclosed by Ciura, rustc_codegen_utc met the criteria for internal production readiness as of early 2026, and it has achieved self-hosting (building the backend itself using the backend) since Rust 1.90. It is reportedly already in use across more than 100 of Microsoft's internal repositories.
However, these maturity figures and assessments are self-reported, based on Ciura's talk and the company's announcements. No results from external independent audits or third-party benchmarks have been published, and the code itself is not widely available as open source. Given its dependence on the proprietary MSVC compiler asset, while this structure improves convenience for Windows builds, it should be noted that external general developers cannot immediately benefit from the same advantages.
Track Record Across More Than 100 Internal Repositories and the "Oxidizer" Distributed Framework
Rust adoption did not suddenly begin with the Tier 1 designation. According to reporting by the UK tech media outlet The Register, Rust has already been deployed in practice across more than 100 of the company's code repositories. Its scope of application has gradually expanded, ranging from low-level systems domains to large-scale distributed cloud services.
A representative example is "Oxidizer," a distributed service framework that Microsoft has released as open source. Created in April 2025 and managed on GitHub under the MIT license, this project consists of a collection of crates (libraries) for building Rust services that demand high scalability and availability.
The Oxidizer repository features a lineup of modular, practical crates: "layered," which provides a service abstraction layer; "fetch," responsible for HTTP client functionality; "seatbelt," a circuit breaker that prevents cascading failures; "cachet," which handles cache control; "routerama," which enables flexible request routing; and "rest_over_grpc," which transparently handles REST APIs over gRPC communication, among others.
According to The Register's reporting, Oxidizer's crates have been used to build and improve backend functionality for core Microsoft 365 services including Outlook, Word, Excel, OneDrive, and SharePoint. Furthermore, Rust code plays an important role in the technical foundation of "Copilot," the suite of generative AI-powered assistance features.
The design philosophy behind the layered crate included in Oxidizer vividly illustrates the company's technical direction. In contrast to "Tower," the asynchronous middleware framework that has become standard in the Rust community, layered adopts a design premised on async functions within traits (async fn in traits) and immutable references (&self)—features introduced into Rust's language specification. This allows for maintainable asynchronous pipelines to be written while keeping type definition complexity in check. Interoperability with the existing tower-service is also maintained, demonstrating that Microsoft is not merely using external open-source assets but is also contributing infrastructure implementations aligned with new language specifications back to the community.
Microsoft's application of Rust spans a wide range of domains, from low-level layers such as firmware, device drivers, hypervisors, and OS kernels, to large-scale microservices running in the cloud. This diverse range of applications is precisely what motivated the development of a proprietary backend tightly integrated with the MSVC toolchain.
The Pursuit of Memory Safety and the Reality of Legacy Assets
The greatest motivation behind Microsoft's strong push for internal Rust adoption is the elimination of vulnerabilities stemming from memory safety issues that have plagued the company for decades.
Rust is a programming language whose development began in 2006 as a personal project by former Mozilla developer Graydon Hoare. While maintaining the high execution performance of C and C++, it enforces a strict type system based on Ownership and Borrowing at the compiler level, eliminating bugs that arise during the process of manually freeing memory. Because it lacks a garbage collector, it has gained support in systems programming contexts that demand predictable resource consumption.
Across the industry as a whole, from databases to package managers, attempts to reimplement existing software in Rust for the purposes of improving performance and ensuring safety have become a common trend. There have even been reports of code replacement efforts proceeding with the aid of AI-assisted tools.
Microsoft's leadership has also long warned of the costs incurred by this lack of safety. Mark Russinovich, CTO of Microsoft Azure, pointed out in his RustConf 2025 keynote that approximately 70 percent of the CVEs (Common Vulnerabilities and Exposures) assigned to Windows stem from memory management issues. This figure is based on Russinovich's explanation during his talk, and breakdown data—such as the total number of Windows CVEs during the relevant period or the absolute number classified as memory-related issues—is not provided in the publicly available materials that could be confirmed. At the time, Russinovich stated that he had long ago realized that no matter how much he wished to improve C or C++, they could never be raised to the level that Rust provides from the outset.
Furthermore, The Register cited the fact that Microsoft's September 2026 monthly security update (Patch Tuesday) addressed a record-high 974 CVEs, and analyzed that Rust's greatest use in the future would likely be reinforcing Windows' existing C/C++ code, which tends to be vulnerability-prone. However, this is media analysis and speculation; Microsoft has not committed to any plan to rewrite the entire Windows codebase in Rust.
The Windows codebase has reached hundreds of millions of lines, the vast majority of which consists of C and C++ code that has been meticulously optimized for performance over time. Rebuilding all of this from scratch in a memory-safe language is impractical, both from an engineering and economic standpoint. What is required in real-world engineering is not a total replacement but a strategy of coexistence—gradually incorporating Rust modules into existing C++ assets step by step.
The Persistent "unsafe" Boundary and the Challenge of Long-Term Migration
Even with Rust elevated to Tier 1 status and integrated with the compiler infrastructure, not all safety-related challenges are automatically resolved overnight. The greatest obstacle lies in controlling the "boundary zones" where existing C++ code connects with new Rust code.
As was repeatedly pointed out during talks and discussions at RustConf 2026, systems development mixing Rust and C++ carries a structural problem in handling "unsafe" regions. Rust's powerful borrow checker guarantees complete safety for memory operations contained within Rust's own type system. However, it has no means of verifying the safety of pointers passed from the C++ side or access to memory regions managed by C++.
When referencing an object located in C++'s memory space from the Rust side, developers inevitably must write an "unsafe" block. Once this boundary is crossed, Rust's compile-time safety guarantees are lost, and dangers equivalent to those in C++ enter the code. For Microsoft engineers managing a massive legacy asset base, managing this dangerous boundary of interoperability between languages is a hands-on challenge they will need to confront for years to come.
There is also a significant gap between the capabilities of the announced rustc_codegen_utc and the environment available to external developers. Features such as cross-language inlining and full Hotpatch compliance are achievable precisely because of internal infrastructure working in close coordination with the MSVC compiler team—external developers cannot currently replicate the same integrated environment through the standard rustc LLVM backend. When external developers use Rust on Windows, they must still rely on build configurations dependent on the standard MSVC linker or the LLVM toolchain.
Microsoft's move to elevate Rust to internal Tier 1 status is undoubtedly an important turning point in the company's software development infrastructure. However, the effort to improve the safety of hundreds of millions of lines of legacy code is still only in its early stages. Whether the proprietary backend will be released externally, whether standardized safe interfaces between languages will emerge, and whether the number of Windows vulnerabilities can actually be reduced—these are questions that will be judged through future operational track record.