{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/arvo-reproducible-vulnerability-dataset-2024/",
 "asOf": "2026-09-26",
 "id": "arvo-reproducible-vulnerability-dataset-2024",
 "date": "2024-08-04",
 "datePrecision": "day",
 "title": "ARVO dataset makes OSS-Fuzz vulnerabilities reproducible with located fixes (over 5,000 at release, 6,100+ by 2026)",
 "lane": "defense",
 "kind": "dataset",
 "summary": "ARVO (Atlas of Reproducible Vulnerabilities for Open Source Software) builds reproducible vulnerability cases from OSS-Fuzz, each with a triggering input, a rebuildable environment and an automatically located fixing patch. The August 2024 first version reported over 5,000 memory vulnerabilities across 250+ C/C++ projects; the authors' June 2026 revision reports over 6,100 vulnerabilities across 311 projects, 81% reproduction success and 89.4% accuracy on located patches. The paper is accepted at IEEE EuroS&P 2026.",
 "whyItMatters": "Reproducible vulnerability/fix pairs are the raw material for evaluating AI repair agents, and ARVO underlies several later benchmarks.",
 "actors": [
  "arizona-state-university",
  "new-york-university"
 ],
 "topics": [
  "vulnerability-repair",
  "eval-validity"
 ],
 "atlas": [
  "eval-environment"
 ],
 "artifacts": [
  "arvo",
  "oss-fuzz"
 ],
 "sources": [
  {
   "url": "https://arxiv.org/abs/2408.02153",
   "publisher": "arXiv",
   "title": "ARVO: Atlas of Reproducible Vulnerabilities for Open-Source Software",
   "date": "2024-08-04",
   "type": "primary",
   "accessed": "2026-09-25"
  },
  {
   "url": "https://github.com/n132/ARVO/blob/main/README.md",
   "publisher": "GitHub (n132/ARVO)",
   "title": "ARVO README",
   "type": "primary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "First version (August 4, 2024): over 5,000 memory vulnerabilities across 250+ C/C++ projects; the authors also report finding more than 300 vulnerabilities that OSS-Fuzz had incorrectly marked as fixed.",
   "locator": "arXiv v1 abstract"
  },
  {
   "fact": "Revised version (June 19, 2026): over 6,100 real-world vulnerabilities across 311 projects; 81% successfully reproduced; 89.4% accuracy on located patches.",
   "locator": "arXiv v2 abstract; README"
  },
  {
   "fact": "The README notes a MemorySanitizer issue that makes some bugs non-reproducible with ASLR enabled.",
   "locator": "README, limitations note"
  }
 ],
 "significance": 3,
 "fideQuestions": [
  "FID-075",
  "FID-088"
 ],
 "methods": [
  "ai-vulnerability-discovery",
  "automated-patching"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}