ARVO (Atlas of Reproducible Vulnerabilities for Open Source Software) builds reproducible vulnerability cases from OSS-Fuzz, each with a triggering input, a rebuildable environment and an automatically located fixing patch. The August 2024 first version reported over 5,000 memory vulnerabilities across 250+ C/C++ projects; the authors' June 2026 revision reports over 6,100 vulnerabilities across 311 projects, 81% reproduction success and 89.4% accuracy on located patches. The paper is accepted at IEEE EuroS&P 2026.
Why it matters
Reproducible vulnerability/fix pairs are the raw material for evaluating AI repair agents, and ARVO underlies several later benchmarks.
Key facts
As stated in the sources, with where to find them.
- First version (August 4, 2024): over 5,000 memory vulnerabilities across 250+ C/C++ projects; the authors also report finding more than 300 vulnerabilities that OSS-Fuzz had incorrectly marked as fixed.arXiv v1 abstract
- Revised version (June 19, 2026): over 6,100 real-world vulnerabilities across 311 projects; 81% successfully reproduced; 89.4% accuracy on located patches.arXiv v2 abstract; README
- The README notes a MemorySanitizer issue that makes some bugs non-reproducible with ASLR enabled.README, limitations note
Findings that cite this record
No tracked finding cites this record yet.
Key questions this bears on
- Is AI shifting the balance between finding and fixing vulnerabilities?Discovery is ahead. AI finds real vulnerabilities faster than they are fixed, and simple checks overstate how often AI patches work.
Sources
Related records
Apr 29, 2025
Sep 3, 2026
Feb 7, 2026
Aug 11, 2024
Jan 17, 2025
Mar 9, 2026