Document: P3596R0
Authors: Joshua Berne, Timur Doumler, Jens Maurer, Shafik Yaghmour
Date: 2026-02-20
Audience: CWG
Someone finally cataloged all of it. Two new Annexes to the C++ standard: one listing every instance of undefined behavior, one listing every instance of ill-formed, no diagnostic required (IFNDR). Developed as a collaborative branch of the working draft, now ready for CWG review. Each entry gets a stable name for cross-referencing. The paper is 100 pages of wording.
100 pages. One hundred pages of undefined behavior and IFNDR, cataloged and cross-referenced. This is the scariest document WG21 has ever produced and also the most useful. Every compiler implementer, static analysis vendor, and language lawyer in the world needs this.
We've been maintaining our own internal UB list for years. Having an official one with stable names means sanitizer diagnostics can reference the standard directly. "Violation of [ub.ptr.arith.oob]" is infinitely better than "pointer arithmetic overflow (probably)."
Shafik Yaghmour has been cataloging C++ UB on Twitter/X and Stack Overflow for years. This is the natural conclusion of that work - make it official, put it in the standard. The author list (Berne, Doumler, Maurer, Yaghmour) is the all-star team for this kind of spec archaeology.
The IFNDR annex is arguably more important than the UB one. Undefined behavior can at least be detected at runtime with sanitizers. IFNDR means your program is ill-formed and the compiler isn't required to tell you. It just silently does something. Having a catalog of every IFNDR in the standard is a prerequisite for any tool that wants to diagnose them.
Stable names for each UB instance. This is huge for tooling. Instead of "see [expr.add] paragraph 4 note 3," tools can reference
[ub.ptr.arith]or whatever the naming convention is. Cross-referencing, searching, versioning - all become tractable when UBs have identifiers.The hard part isn't writing the annexes. The hard part is maintaining them. Every paper that adds, removes, or modifies UB needs to update the annex. The paper acknowledges this by developing it as a branch of the working draft - which means the editors take on the maintenance burden. Jens Maurer being an author and an editor is probably why this is feasible.
This connects directly to the Profiles effort. If you want a profile that eliminates specific categories of UB (e.g. "no out-of-bounds access"), you need a catalog of what those categories are. This paper provides the catalog. Profiles provide the enforcement mechanism. They're complementary.
P1705R1 tried this before and didn't make it through. P2234R0 called for it. P3075R0 called for it again. Third time's the charm, apparently. Having four co-authors who know the spec inside and out is probably why this one will stick.
I'm going to assign this as reading to my advanced C++ class. "Here is everything that can go wrong with your program, indexed and cross-referenced." Best horror novel of 2026.
Rust has exactly one kind of UB: calling
unsafecode incorrectly. C++ needs a 100-page annex to list all of its UBs. This is the kind of thing that makes safety-focused organizations choose Rust.Rust has a list of UB too. It's shorter. But "calling unsafe code incorrectly" is doing a lot of heavy lifting when unsafe blocks are used in every non-trivial Rust codebase.
Has anyone counted the total number of distinct UB instances in the annex? I want to know the exact number so I can use it in presentations.
97% upvoted. The one thing r/wg21 can agree on: knowing where the UB is beats not knowing.