Wherein I propose that C++ initialize all stack variables to zero, preventing ~10% of CVEs.
Cost: none.
One slightly abstruse disadvantage: currently it's possible to tell that someone is incorrectly depending on uninitialized values (at least at runtime, and often statically), because the condition can be evaluated. In the proposed world there is no automatic way of testing whether one is accidentally using the initial value of a variable without intending to, because there's no automatically detectable difference between "actually wanted to read the default zero" and "didn't want to read anything but a value that should have been written in there, but the value was accidentally not written yet".
So, we will make most of those CVEs harmless, but some fraction will remain as security issues, but won't be automatically findable anymore. Still, this would probably be a net benefit.
