{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T05:01:09Z","timestamp":1785474069673,"version":"3.56.0"},"reference-count":35,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"Defense Advanced Research Projects Agency"},{"name":"Office of Naval Research"},{"name":"Australian Research Council"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,7]]},"DOI":"10.1109\/eurosp68448.2026.00060","type":"proceedings-article","created":{"date-parts":[[2026,7,30]],"date-time":"2026-07-30T19:08:02Z","timestamp":1785438482000},"page":"860-873","source":"Crossref","is-referenced-by-count":0,"title":["ARVO: Atlas of Reproducible Vulnerabilities for Open-Source Software"],"prefix":"10.1109","author":[{"given":"Xiang","family":"Mei","sequence":"first","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jordi Del","family":"Castillo","sequence":"additional","affiliation":[{"name":"New York University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Pulkit","family":"Singh Singaria","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Haoran","family":"Xi","sequence":"additional","affiliation":[{"name":"New York University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Abdelouahab","family":"Benchikh","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tiffany","family":"Bao","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ruoyu","family":"Wang","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yan","family":"Shoshitaishvili","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Adam","family":"Doup\u00e9","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hammond","family":"Pearce","sequence":"additional","affiliation":[{"name":"University of New South Wales"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Brendan","family":"Dolan-Gavitt","sequence":"additional","affiliation":[{"name":"XBOW"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243804"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.15"},{"key":"ref3","volume-title":"CGC dataset","year":"2016"},{"key":"ref4","first-page":"919","article-title":"Understanding the reproducibility of crowd-reported security vulnerabilities","volume-title":"27th USENIX Security Symposium (USENIX Security 18)","author":"Mu"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3428334"},{"key":"ref6","volume-title":"OSS-Fuzz - Google\u2019s continuous fuzzing service for open source software","author":"Serebryany","year":"2017"},{"key":"ref7","volume-title":"osv.dev","year":"2024"},{"key":"ref8","volume-title":"AI Cyber Challenge (AIxCC)","year":"2025"},{"key":"ref9","author":"Wang","year":"2025","journal-title":"CyberGym: Evaluating AI agents\u2019 cybersecurity capabilities with real-world vulnerabilities at scale"},{"key":"ref10","article-title":"PATCHAGENT: A practical program repair agent mimicking human expertise","volume-title":"USENIX Security Symposium (USENIX Security \u201925)","author":"Yu"},{"key":"ref11","volume-title":"CISA Open Source Software Security Roadmap","year":"2023"},{"key":"ref12","volume-title":"Octoverse: AI leads Python to top language as the number of global developers surges","year":"2024"},{"key":"ref13","volume-title":"AddressSanitizer","year":"2024"},{"key":"ref14","first-page":"1147","article-title":"BScout: Direct whole patch presence test for java executables","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Dai"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417240"},{"key":"ref16","first-page":"887","article-title":"Precise and accurate patch presence test for binaries","volume-title":"27th USENIX Security Symposium (USENIX Security 18)","author":"Zhang"},{"key":"ref17","article-title":"OPUS: Online patches and updates for security","volume-title":"14th USENIX Security Symposium (USENIX Security 05)","author":"Altekar"},{"key":"ref18","first-page":"1253","article-title":"Adaptive android kernel live patching","volume-title":"26th USENIX Security Symposium (USENIX Security 17)","author":"Chen"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3475960.3475985"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813604"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484593"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3418461"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3617555.3617874"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-SEIP52600.2021.00020"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/3379597.3387501"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/icse55347.2025.00038"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/3607199.3607242"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2011.104"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/3318162"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134072"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3412376"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3460319.3464821"},{"key":"ref34","volume-title":"OSS-Fuzz issue 42486945"},{"key":"ref35","volume-title":"libheif: Update readme"},{"key":"ref36","volume-title":"libheif: Fix incorrect memcpy size"}],"event":{"name":"2026 IEEE 11th European Symposium on Security and Privacy (EuroS&P)","location":"Lisbon, Portugal","start":{"date-parts":[[2026,7,6]]},"end":{"date-parts":[[2026,7,10]]}},"container-title":["2026 IEEE 11th European Symposium on Security and Privacy (EuroS&P)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11624144\/11623655\/11624217.pdf?arnumber=11624217","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T04:53:09Z","timestamp":1785473589000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11624217\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7]]},"references-count":35,"URL":"https:\/\/doi.org\/10.1109\/eurosp68448.2026.00060","relation":{},"subject":[],"published":{"date-parts":[[2026,7]]}}}