Aug 4, 2024
ARVO dataset makes OSS-Fuzz vulnerabilities reproducible with located fixes (over 5,000 at release, 6,100+ by 2026)
ARVO (Atlas of Reproducible Vulnerabilities for Open Source Software) builds reproducible vulnerability cases from OSS-Fuzz, each with a triggering input, a rebuildable environment and an automatically located fixing patch. The August 2024 first version reported over 5,000 memory vulnerabilities across 250+ C/C++ projects; the authors' June 2026 revision reports over 6,100 vulnerabilities across 311 projects, 81% reproduction success and 89.4% accuracy on located patches. The paper is accepted at IEEE EuroS&P 2026.