{"id":"https://openalex.org/W4403369799","doi":"https://doi.org/10.1109/eurosp68448.2026.00060","title":"ARVO: Atlas of Reproducible Vulnerabilities for Open-Source Software","display_name":"ARVO: Atlas of Reproducible Vulnerabilities for Open-Source Software","publication_year":2026,"publication_date":"2026-07-01","ids":{"openalex":"https://openalex.org/W4403369799","doi":"https://doi.org/10.1109/eurosp68448.2026.00060"},"language":"en","primary_location":{"id":"doi:10.1109/eurosp68448.2026.00060","is_oa":false,"landing_page_url":"https://doi.org/10.1109/eurosp68448.2026.00060","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 IEEE 11th European Symposium on Security and Privacy (EuroS&P)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2408.02153","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5111397823","display_name":"Xiang Mei","orcid":null},"institutions":[{"id":"https://openalex.org/I55732556","display_name":"Arizona State University","ror":"https://ror.org/03efmqc40","country_code":"US","type":"education","lineage":["https://openalex.org/I55732556"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xiang Mei","raw_affiliation_strings":["Arizona State University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Arizona State University","institution_ids":["https://openalex.org/I55732556"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5040173824","display_name":"Jordi Del Castillo","orcid":null},"institutions":[{"id":"https://openalex.org/I57206974","display_name":"New York University","ror":"https://ror.org/0190ak572","country_code":"US","type":"education","lineage":["https://openalex.org/I57206974"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jordi Del Castillo","raw_affiliation_strings":["New York University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"New York University","institution_ids":["https://openalex.org/I57206974"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5111397824","display_name":"Pulkit Singh Singaria","orcid":null},"institutions":[{"id":"https://openalex.org/I55732556","display_name":"Arizona State University","ror":"https://ror.org/03efmqc40","country_code":"US","type":"education","lineage":["https://openalex.org/I55732556"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Pulkit Singh Singaria","raw_affiliation_strings":["Arizona State University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Arizona State University","institution_ids":["https://openalex.org/I55732556"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101377025","display_name":"Haoran Xi","orcid":null},"institutions":[{"id":"https://openalex.org/I57206974","display_name":"New York University","ror":"https://ror.org/0190ak572","country_code":"US","type":"education","lineage":["https://openalex.org/I57206974"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Haoran Xi","raw_affiliation_strings":["New York University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"New York University","institution_ids":["https://openalex.org/I57206974"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5111397826","display_name":"Benchikh","orcid":null},"institutions":[{"id":"https://openalex.org/I55732556","display_name":"Arizona State University","ror":"https://ror.org/03efmqc40","country_code":"US","type":"education","lineage":["https://openalex.org/I55732556"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Abdelouahab Benchikh","raw_affiliation_strings":["Arizona State University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Arizona State University","institution_ids":["https://openalex.org/I55732556"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5076987446","display_name":"Tiffany Bao","orcid":"https://orcid.org/0000-0001-6424-0001"},"institutions":[{"id":"https://openalex.org/I55732556","display_name":"Arizona State University","ror":"https://ror.org/03efmqc40","country_code":"US","type":"education","lineage":["https://openalex.org/I55732556"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Tiffany Bao","raw_affiliation_strings":["Arizona State University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Arizona State University","institution_ids":["https://openalex.org/I55732556"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100653715","display_name":"Ruoyu Wang","orcid":"https://orcid.org/0000-0003-4623-6724"},"institutions":[{"id":"https://openalex.org/I55732556","display_name":"Arizona State University","ror":"https://ror.org/03efmqc40","country_code":"US","type":"education","lineage":["https://openalex.org/I55732556"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ruoyu Wang","raw_affiliation_strings":["Arizona State University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Arizona State University","institution_ids":["https://openalex.org/I55732556"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5026842092","display_name":"Yan Shoshitaishvili","orcid":"https://orcid.org/0000-0001-8832-1789"},"institutions":[{"id":"https://openalex.org/I55732556","display_name":"Arizona State University","ror":"https://ror.org/03efmqc40","country_code":"US","type":"education","lineage":["https://openalex.org/I55732556"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yan Shoshitaishvili","raw_affiliation_strings":["Arizona State University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Arizona State University","institution_ids":["https://openalex.org/I55732556"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5050806439","display_name":"Adam Doup\u00e9","orcid":"https://orcid.org/0000-0003-2634-3901"},"institutions":[{"id":"https://openalex.org/I55732556","display_name":"Arizona State University","ror":"https://ror.org/03efmqc40","country_code":"US","type":"education","lineage":["https://openalex.org/I55732556"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Adam Doup\u00e9","raw_affiliation_strings":["Arizona State University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Arizona State University","institution_ids":["https://openalex.org/I55732556"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5053148078","display_name":"Hammond Pearce","orcid":"https://orcid.org/0000-0002-3488-7004"},"institutions":[{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Hammond Pearce","raw_affiliation_strings":["University of New South Wales"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of New South Wales","institution_ids":["https://openalex.org/I31746571"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5134139272","display_name":"Brendan Dolan-Gavitt","orcid":null},"institutions":[{"id":"https://openalex.org/I4210124643","display_name":"Rainbow Medical (Israel)","ror":"https://ror.org/039xjj562","country_code":"IL","type":"company","lineage":["https://openalex.org/I4210124643"]}],"countries":["IL"],"is_corresponding":false,"raw_author_name":"Brendan Dolan-Gavitt","raw_affiliation_strings":["XBOW"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"XBOW","institution_ids":["https://openalex.org/I4210124643"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":{"value":0.00148441,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":95},"biblio":{"volume":null,"issue":null,"first_page":"860","last_page":"873"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.8866000175476074,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.8866000175476074,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.8791999816894531,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.8644000291824341,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/open-source","display_name":"Open source","score":0.6741311550140381},{"id":"https://openalex.org/keywords/atlas","display_name":"Atlas (anatomy)","score":0.6728596687316895},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.611657440662384},{"id":"https://openalex.org/keywords/open-source-software","display_name":"Open source software","score":0.5540107488632202},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5296340584754944},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.17296668887138367},{"id":"https://openalex.org/keywords/geology","display_name":"Geology","score":0.107296884059906}],"concepts":[{"id":"https://openalex.org/C3018397939","wikidata":"https://www.wikidata.org/wiki/Q3644502","display_name":"Open source","level":3,"score":0.6741311550140381},{"id":"https://openalex.org/C2776673561","wikidata":"https://www.wikidata.org/wiki/Q655357","display_name":"Atlas (anatomy)","level":2,"score":0.6728596687316895},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.611657440662384},{"id":"https://openalex.org/C2988343187","wikidata":"https://www.wikidata.org/wiki/Q1130645","display_name":"Open source software","level":3,"score":0.5540107488632202},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5296340584754944},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.17296668887138367},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.107296884059906},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0}],"mesh":[],"locations_count":6,"locations":[{"id":"doi:10.1109/eurosp68448.2026.00060","is_oa":false,"landing_page_url":"https://doi.org/10.1109/eurosp68448.2026.00060","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 IEEE 11th European Symposium on Security and Privacy (EuroS&P)","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2408.02153","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2408.02153","pdf_url":"https://arxiv.org/pdf/2408.02153","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"text"},{"id":"pmh:oai:arXiv.org:2408.02153","is_oa":true,"landing_page_url":"https://arxiv.org/abs/2408.02153","pdf_url":"https://arxiv.org/pdf/2408.02153","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"pmh:oai:arXiv.org:2606.17283","is_oa":true,"landing_page_url":"https://arxiv.org/abs/2606.17283","pdf_url":"https://arxiv.org/pdf/2606.17283","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2408.02153","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2408.02153","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.48550/arxiv.2606.17283","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.17283","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2408.02153","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2408.02153","pdf_url":"https://arxiv.org/pdf/2408.02153","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"text"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G10928504","display_name":"CAREER: Achieving Autonomous Symbolic Execution through Learning from Humans","funder_award_id":"2442984","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G2388950480","display_name":null,"funder_award_id":"N00014-23-1-2563","funder_id":"https://openalex.org/F4320337345","funder_display_name":"Office of Naval Research"},{"id":"https://openalex.org/G3274594104","display_name":"NSF-SFS: Arizona Cyber Defense Scholarship","funder_award_id":"1663651","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G429732035","display_name":"SaTC: CORE: Medium: Symbolizing Viability: Paving the Road to Practical Symbolic Execution","funder_award_id":"2247954","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G6411643898","display_name":"CICI: TCR: Improving the Robustness of Cyberinfrastructure via Scalable Vulnerability Discovery and Mitigation on \"Big Binaries\"","funder_award_id":"2232915","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G7105599594","display_name":null,"funder_award_id":"N00014-23","funder_id":"https://openalex.org/F4320337345","funder_display_name":"Office of Naval Research"},{"id":"https://openalex.org/G8049548440","display_name":"CAREER: Re-configurable, Source-Language-Agnostic Decompilation for Binary Programs","funder_award_id":"2146568","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G8876996369","display_name":null,"funder_award_id":"N00014","funder_id":"https://openalex.org/F4320337345","funder_display_name":"Office of Naval Research"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320306078","display_name":"U.S. Department of Defense","ror":"https://ror.org/0447fe631"},{"id":"https://openalex.org/F4320315885","display_name":"Australian Government","ror":"https://ror.org/0314h5y94"},{"id":"https://openalex.org/F4320332180","display_name":"Defense Advanced Research Projects Agency","ror":"https://ror.org/02caytj08"},{"id":"https://openalex.org/F4320332815","display_name":"Advanced Research Projects Agency","ror":"https://ror.org/02caytj08"},{"id":"https://openalex.org/F4320337345","display_name":"Office of Naval Research","ror":"https://ror.org/00rk2pe57"}],"has_content":{"grobid_xml":false,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4403369799.pdf"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4376877853","https://openalex.org/W1493891899","https://openalex.org/W4250928611","https://openalex.org/W166480398","https://openalex.org/W1612808768","https://openalex.org/W167327709","https://openalex.org/W1977393088","https://openalex.org/W4387839566","https://openalex.org/W4210922265","https://openalex.org/W2288962794"],"abstract_inverted_index":{"Achieving":[0],"reproducibility,":[1,141],"quantity,":[2],"and":[3,51,90,112,160,176,202,219],"diversity":[4],"in":[5,122,151],"vulnerability":[6,109,150,175],"datasets":[7,146,189],"has":[8,32,40,52],"long":[9],"been":[10,33],"viewed":[11],"as":[12],"an":[13],"inherent":[14],"three-way":[15],"trade-off,":[16],"where":[17],"improving":[18],"one":[19],"dimension":[20,35],"often":[21,37],"comes":[22],"at":[23,79],"the":[24,27,34,83,104,114,170,207],"cost":[25],"of":[26,119,131,169,200],"others.":[28],"In":[29,60,193],"practice,":[30],"reproducibility":[31,75,102],"most":[36],"neglected.":[38],"This":[39],"limited":[41],"what":[42],"can":[43,155],"be":[44,156],"automatically":[45],"extracted":[46],"from":[47,144],"historical":[48],"bug":[49,88],"datasets,":[50],"reduced":[53],"their":[54],"utility":[55],"for":[56,76,173],"downstream":[57,220],"security":[58,71,221],"research.":[59,222],"this":[61,97],"work,":[62],"we":[63,99],"propose":[64],"a":[65,69,127,152],"method":[66],"to":[67,86,103],"produce":[68],"new":[70],"dataset":[72,110,116,129],"which":[73],"ensures":[74],"diverse":[77],"vulnerabilities":[78,135,181,201],"scale":[80],"by":[81,147],"identifying":[82],"key":[84],"obstacles":[85],"large-scale":[87,128,188],"reproduction":[89],"addressing":[91],"them":[92],"with":[93,180],"general":[94],"solutions.":[95],"Using":[96],"method,":[98],"introduce":[100],"full":[101],"largest":[105],"open":[106],"source":[107],"software":[108],"(OSS-Fuzz)":[111],"construct":[113],"ARVO":[115,125,142,196],"(an":[117],"Atlas":[118],"Reproducible":[120],"Vulnerabilities":[121],"Open-source":[123],"software).":[124],"is":[126],"consisting":[130],"over":[132],"6,100":[133],"real-world":[134],"across":[136,162],"311":[137],"projects.":[138],"Focusing":[139],"on":[140,206,215],"differs":[143],"existing":[145,187],"providing":[148],"each":[149,174],"form":[153],"that":[154,186],"consistently":[157],"rebuilt,":[158],"triggered,":[159],"analyzed":[161],"versions.":[163],"Reproducibility":[164],"also":[165,211],"enables":[166],"automatic":[167],"identification":[168],"corresponding":[171],"patch":[172],"supports":[177],"direct":[178],"interaction":[179],"after":[182],"code":[183],"changes,":[184],"capabilities":[185],"do":[190],"not":[191],"provide.":[192],"our":[194],"evaluation,":[195],"successfully":[197],"reproduces":[198],"81%":[199],"achieves":[203],"89.4%":[204],"accuracy":[205],"located":[208],"patches.":[209],"We":[210],"discuss":[212],"ARVO's":[213],"influence":[214],"both":[216],"upstream":[217],"practices":[218]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":1}],"updated_date":"2026-08-05T07:39:15.569665","created_date":"2025-10-10T00:00:00"}