A foreign-function interface, or FFI, is the boundary that lets code written in one programming language call functions implemented in another. It is common when a safer language such as Rust, Python, or Go needs to use existing C or C++ libraries, system APIs, or performance-critical native code.
FFI matters in cyber security because it is a trust boundary. The caller and callee may disagree about memory ownership, buffer sizes, data layout, error handling, or calling conventions. Those mistakes can reintroduce the same memory-corruption risks that safer languages are meant to avoid. Attackers often look for flaws in FFI wrappers, where bad validation or unsafe pointer handling can lead to crashes, information leaks, or code execution. Defenders use FFI to migrate legacy code gradually, but they should keep the native surface small, validate inputs carefully, and isolate high-risk components.