{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:14:59Z","timestamp":1766441699533,"version":"3.48.0"},"publisher-location":"New York, NY, USA","reference-count":63,"publisher":"ACM","funder":[{"name":"National Natural Science Foundation of China (NSFC)","award":["62302181"],"award-info":[{"award-number":["62302181"]}]},{"name":"Key R&D Program of Hubei Province","award":["2023BAB079, 2023BAB017"],"award-info":[{"award-number":["2023BAB079, 2023BAB017"]}]},{"name":"National Science Foundation (NSF)","award":["OAC-2115167"],"award-info":[{"award-number":["OAC-2115167"]}]},{"name":"Battelle Energy Alliance, LLC","award":["313367"],"award-info":[{"award-number":["313367"]}]},{"name":"Hong Kong Polytechnic University Grant","award":["1-ZVG0"],"award-info":[{"award-number":["1-ZVG0"]}]},{"name":"Hong Kong RGC Grant","award":["T43-513\/23-N"],"award-info":[{"award-number":["T43-513\/23-N"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,11,19]]},"DOI":"10.1145\/3719027.3744807","type":"proceedings-article","created":{"date-parts":[[2025,11,22]],"date-time":"2025-11-22T23:32:38Z","timestamp":1763854358000},"page":"798-812","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Error Messages to Fuzzing: Detecting XPS Parsing Vulnerabilities in Windows Printing Components"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-3866-4070","authenticated-orcid":false,"given":"Yunpeng","family":"Tian","sequence":"first","affiliation":[{"name":"Hubei Key Laboratory of Distributed System Security, Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology, Huazhong University of Science and Technology, Wuhan, China and The Hong Kong Polytechnic University, Hong Kong, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7091-2169","authenticated-orcid":false,"given":"Feng","family":"Dong","sequence":"additional","affiliation":[{"name":"Hubei Key Laboratory of Distributed System Security, Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-4328-5413","authenticated-orcid":false,"given":"Junhai","family":"Wang","sequence":"additional","affiliation":[{"name":"Hubei Key Laboratory of Distributed System Security, Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5905-9515","authenticated-orcid":false,"given":"Mu","family":"Zhang","sequence":"additional","affiliation":[{"name":"University of Utah, Salt Lake City, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8463-1971","authenticated-orcid":false,"given":"Zhiniang","family":"Peng","sequence":"additional","affiliation":[{"name":"Hubei Key Laboratory of Distributed System Security, Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-0353-6307","authenticated-orcid":false,"given":"Zesen","family":"Ye","sequence":"additional","affiliation":[{"name":"Beijing CyberKunlun Technology Co., Ltd, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9082-3208","authenticated-orcid":false,"given":"Xiapu","family":"Luo","sequence":"additional","affiliation":[{"name":"The Hong Kong Polytechnic University, Hong Kong, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1100-8633","authenticated-orcid":false,"given":"Haoyu","family":"Wang","sequence":"additional","affiliation":[{"name":"Hubei Key Laboratory of Distributed System Security, Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,11,22]]},"reference":[{"unstructured":"2021. CVE-2021--34527. https:\/\/cve.mitre.org\/cgi-bin\/cvename.cginame=CVE-2021--34527.","key":"e_1_3_2_1_1_1"},{"key":"e_1_3_2_1_2_1","volume-title":"NAUTILUS: Fishing for Deep Bugs with Grammars.. In NDSS.","author":"Aschermann Cornelius","year":"2019","unstructured":"Cornelius Aschermann, Tommaso Frassetto, Thorsten Holz, Patrick Jauernig, Ahmad-Reza Sadeghi, and Daniel Teuchert. 2019. NAUTILUS: Fishing for Deep Bugs with Grammars.. In NDSS."},{"doi-asserted-by":"publisher","key":"e_1_3_2_1_3_1","DOI":"10.1145\/3062341.3062349"},{"key":"e_1_3_2_1_4_1","volume-title":"28th USENIX Security Symposium (USENIX Security 19)","author":"Blazytko Tim","year":"2019","unstructured":"Tim Blazytko, Cornelius Aschermann, Moritz Schl\u00f6gel, Ali Abbasi, Sergej Schumilo, Simon W\u00f6rner, and Thorsten Holz. 2019. GRIMOIRE: Synthesizing Structure while Fuzzing. In 28th USENIX Security Symposium (USENIX Security 19)."},{"key":"e_1_3_2_1_5_1","volume-title":"NtFuzz: Enabling Type-Aware Kernel Fuzzing on Windows with Static Binary Analysis. In 2021 IEEE Symposium on Security and Privacy (SP).","author":"Choi Jaeseung","year":"2021","unstructured":"Jaeseung Choi, Kangsu Kim, Daejin Lee, and Sang Kil Cha. 2021. NtFuzz: Enabling Type-Aware Kernel Fuzzing on Windows with Static Binary Analysis. In 2021 IEEE Symposium on Security and Privacy (SP)."},{"doi-asserted-by":"publisher","key":"e_1_3_2_1_6_1","DOI":"10.1109\/ICACT.2008.4494042"},{"unstructured":"CISA. 2021. PrintNightmare Critical Windows Print Spooler Vulnerability. https:\/\/www.cisa.gov\/news-events\/alerts\/2021\/06\/30\/printnightmare-critical-windows-print-spooler-vulnerability.","key":"e_1_3_2_1_7_1"},{"key":"e_1_3_2_1_8_1","volume-title":"Network and Distributed System Security Symposium (NDSS","author":"Cui Ang","year":"2013","unstructured":"Ang Cui, Michael Costello, and Salvatore Stolfo. 2013. When firmware modifications attack: A case study of embedded exploitation. In Network and Distributed System Security Symposium (NDSS 2013)."},{"unstructured":"Saif El-Sherei. 2017. Demystifying Kernel Exploitation by Abusing GDI Objects. In DEF CON 25.","key":"e_1_3_2_1_9_1"},{"unstructured":"Nicolas Falliere Liam O Murchu and Eric Chien. 2011. W32.Stuxnet Dossier. https:\/\/www.symantec.com\/content\/en\/us\/enterprise\/media\/security_response-\/whitepapers\/w32_stuxnet_dossier.pdf.","key":"e_1_3_2_1_10_1"},{"key":"e_1_3_2_1_11_1","volume-title":"Proceedings of the 4th Conference on USENIX Windows Systems Symposium -","volume":"4","author":"Justin","unstructured":"Justin E. Forrester and Barton P. Miller. 2000. An Empirical Study of the Robustness of Windows NT Applications Using Random Testing. In Proceedings of the 4th Conference on USENIX Windows Systems Symposium - Volume 4 (Seattle, Washington) (WSS'00). USENIX Association, USA, 6."},{"unstructured":"GNOME. 2010. libgxps. https:\/\/github.com\/GNOME\/libgxps","key":"e_1_3_2_1_12_1"},{"volume-title":"Proceedings of the 29th ACM SIGPLAN Conference on Programming Language Design and Implementation.","author":"Godefroid Patrice","unstructured":"Patrice Godefroid, Adam Kiezun, and Michael Y. Levin. 2008. Grammar-based whitebox fuzzing. In Proceedings of the 29th ACM SIGPLAN Conference on Programming Language Design and Implementation.","key":"e_1_3_2_1_13_1"},{"doi-asserted-by":"publisher","key":"e_1_3_2_1_14_1","DOI":"10.1109\/ASE.2017.8115618"},{"unstructured":"Google Project Zero. 2016. WinAFL. https:\/\/github.com\/googleprojectzero\/winafl.","key":"e_1_3_2_1_15_1"},{"unstructured":"Google Project Zero. 2020. TinyInst. https:\/\/github.com\/googleprojectzero\/TinyInst.","key":"e_1_3_2_1_16_1"},{"unstructured":"Rahul Gopinath Bj\u00f6rn Mathis Mathias H\u00f6schele Alexander Kampmann and Andreas Zeller. 2018. Sample-Free Learning of Input Grammars for Comprehensive Software Fuzzing. arXiv:1810.08289 [cs.SE]","key":"e_1_3_2_1_17_1"},{"doi-asserted-by":"crossref","unstructured":"Yeming Gu Hui Shu Rongkuan Ma Lin Yan and Lei Zhu. 2022. spotFuzzer: Static Instrument and Fuzzing Windows COTs. arXiv:2201.07938 [cs.SE]","key":"e_1_3_2_1_18_1","DOI":"10.1155\/2022\/4911587"},{"unstructured":"Marc Heuse. 2018. AFL-DynamoRIO. https:\/\/github.com\/vanhauser-thc\/afl-dynamorio.","key":"e_1_3_2_1_19_1"},{"unstructured":"HexRays. 2024. IDA Pro. https:\/\/www.hex-rays.com.","key":"e_1_3_2_1_20_1"},{"unstructured":"Honggfuzz 2010. Honggfuzz. https:\/\/github.com\/google\/honggfuzz.","key":"e_1_3_2_1_21_1"},{"unstructured":"Linghan Huang Peizhou Zhao Huaming Chen and Lei Ma. 2024. Large Language Models Based Fuzzing Techniques: A Survey. arXiv:2402.00350 [cs.SE] https:\/\/arxiv.org\/abs\/2402.00350","key":"e_1_3_2_1_22_1"},{"key":"e_1_3_2_1_23_1","volume-title":"Proceedings of the 26th USENIX Conference on Security Symposium. 149--165","author":"Jianfeng Pan","year":"2017","unstructured":"Pan Jianfeng, Yan Guanglu, and Fan Xiaocao. 2017. Digtool: a virtualization-based framework for detecting kernel vulnerabilities. In Proceedings of the 26th USENIX Conference on Security Symposium. 149--165."},{"key":"e_1_3_2_1_24_1","volume-title":"When Fuzzing Meets LLMs: Challenges and Opportunities. In Companion Proceedings of the 32nd ACM International Conference on the Foundations of Software Engineering (FSE","author":"Jiang Yu","year":"2024","unstructured":"Yu Jiang, Jie Liang, Fuchen Ma, Yuanliang Chen, Chijin Zhou, Yuheng Shen, Zhiyong Wu, Jingzhou Fu, Mingzhe Wang, Shanshan Li, and Quan Zhang. 2024. When Fuzzing Meets LLMs: Challenges and Opportunities. In Companion Proceedings of the 32nd ACM International Conference on the Foundations of Software Engineering (FSE 2024)."},{"doi-asserted-by":"publisher","key":"e_1_3_2_1_25_1","DOI":"10.14722\/ndss.2021.24334"},{"key":"e_1_3_2_1_26_1","volume-title":"Diving Into Spooler: Discovering LPE and RCE Vulnerabilities in Windows Printer. In Black Hat USA","author":"Lewis Lee Zhiniang Peng","year":"2021","unstructured":"Zhiniang Peng Lewis Lee, XueFeng Li. 2021. Diving Into Spooler: Discovering LPE and RCE Vulnerabilities in Windows Printer. In Black Hat USA 2021."},{"key":"e_1_3_2_1_27_1","volume-title":"Vijay Janapa Reddi, and Kim Hazelwood","author":"Luk Chi-Keung","year":"2005","unstructured":"Chi-Keung Luk, Robert Cohn, Robert Muth, Harish Patil, Artur Klauser, Geoff Lowney, Steven Wallace, Vijay Janapa Reddi, and Kim Hazelwood. 2005. Pin: building customized program analysis tools with dynamic instrumentation. Acm sigplan notices 40, 6 (2005), 190--200."},{"key":"e_1_3_2_1_28_1","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Ma Xiaoyue","year":"2024","unstructured":"Xiaoyue Ma, Lannan Luo, and Qiang Zeng. 2024. From One Thousand Pages of Specification to Unveiling Hidden Bugs: Large Language Model Assisted Fuzzing of Matter IoT Devices. In 33rd USENIX Security Symposium (USENIX Security 24)."},{"unstructured":"Alexander Markov. 2024. xmlfuzzer. https:\/\/komar.in\/en\/code\/xmlfuzzer.","key":"e_1_3_2_1_29_1"},{"doi-asserted-by":"publisher","key":"e_1_3_2_1_30_1","DOI":"10.14722\/ndss.2024.24556"},{"unstructured":"Microsoft. 2007. XPS Specification and Reference Guide. https:\/\/www.ecma-international.org\/wp-content\/uploads\/XPS-Standard.pdf.","key":"e_1_3_2_1_31_1"},{"unstructured":"Microsoft. 2010. Microsoft Security Bulletin MS10-061 - Critical. https:\/\/learn.microsoft.com\/en-us\/security-updates\/securitybulletins\/2010\/ms10-061.","key":"e_1_3_2_1_32_1"},{"unstructured":"Microsoft. 2021. Debugging Printer Driver Components. https:\/\/learn.microsoft.com\/en-us\/windows-hardware\/drivers\/print\/debugging-printer-driver-components.","key":"e_1_3_2_1_33_1"},{"unstructured":"Microsoft. 2021. Print Spooler. https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/printdocs\/print-spooler.","key":"e_1_3_2_1_34_1"},{"unstructured":"Microsoft. 2021. XPS Document API. https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/printdocs\/documents-xps.","key":"e_1_3_2_1_35_1"},{"unstructured":"Microsoft. 2022. Application Verifier - Overview. https:\/\/learn.microsoft.com\/en-us\/windows-hardware\/drivers\/devtest\/application-verifier.","key":"e_1_3_2_1_36_1"},{"unstructured":"Microsoft. 2022. GFlags and PageHeap - Windows drivers. https:\/\/learn.microsoft.com\/en-us\/windows-hardware\/drivers\/debugger\/gflags-and-pageheap.","key":"e_1_3_2_1_37_1"},{"unstructured":"Microsoft. 2022. Windows Hypervisor Platform API Definitions. https:\/\/learn.microsoft.com\/en-us\/virtualization\/api\/hypervisor-platform\/hypervisor-platform.","key":"e_1_3_2_1_38_1"},{"unstructured":"Microsoft. 2023. A new modern and secure print experience from Windows. https:\/\/techcommunity.microsoft.com\/t5\/security-compliance-and-identity\/a-new-modern-and-secure-print-experience-from-windows\/ba-p\/4002645.","key":"e_1_3_2_1_39_1"},{"unstructured":"Microsoft. 2023. End of servicing plan for third-party printer drivers on Windows. https:\/\/learn.microsoft.com\/en-us\/windows-hardware\/drivers\/print\/end-of-servicing-plan-for-third-party-printer-drivers-on-windows.","key":"e_1_3_2_1_40_1"},{"unstructured":"Microsoft. 2023. Introduction to Point and Print. https:\/\/learn.microsoft.com\/en-us\/windows-hardware\/drivers\/print\/introduction-to-point-and-print.","key":"e_1_3_2_1_41_1"},{"unstructured":"Microsoft. 2023. Office Open XML file formats. https:\/\/ecma-international.org\/publications-and-standards\/standards\/ecma-376\/.","key":"e_1_3_2_1_42_1"},{"unstructured":"Microsoft. 2023. Standard XPS Filters. https:\/\/learn.microsoft.com\/en-us\/windows-hardware\/drivers\/print\/standard-xps-filters.","key":"e_1_3_2_1_43_1"},{"unstructured":"Microsoft. 2024. Process Monitor. https:\/\/learn.microsoft.com\/en-us\/sysinternals\/downloads\/procmon.","key":"e_1_3_2_1_44_1"},{"unstructured":"Microsoft. 2024. V4 printer driver. https:\/\/learn.microsoft.com\/en-us\/windows-hardware\/drivers\/print\/v4-printer-driver.","key":"e_1_3_2_1_45_1"},{"unstructured":"Microsoft. 2024. WinDbg. http:\/\/www.windbg.org.","key":"e_1_3_2_1_46_1"},{"unstructured":"Microsoft. 2024. Windows Presentation Foundation documentation. https:\/\/learn.microsoft.com\/en-us\/dotnet\/desktop\/wpf\/.","key":"e_1_3_2_1_47_1"},{"unstructured":"Microsoft. 2024. XPS Printer Driver (XPSDrv). https:\/\/learn.microsoft.com\/en-us\/windows-hardware\/drivers\/print\/xpsdrv-printer-driver.","key":"e_1_3_2_1_48_1"},{"volume-title":"a new symbolic model checker","year":"2024","unstructured":"NuSMV: a new symbolic model checker 2024. NuSMV: a new symbolic model checker. https:\/\/nusmv.fbk.eu\/.","key":"e_1_3_2_1_49_1"},{"unstructured":"Peach Fuzzer 2024. Peach Fuzzer. https:\/\/peachtech.gitlab.io\/peach-fuzzer-community\/.","key":"e_1_3_2_1_50_1"},{"key":"e_1_3_2_1_51_1","volume-title":"X-Force: Force-Executing Binary Programs for Security Applications. In 23rd USENIX Security Symposium (USENIX Security 14)","author":"Peng Fei","year":"2014","unstructured":"Fei Peng, Zhui Deng, Xiangyu Zhang, Dongyan Xu, Zhiqiang Lin, and Zhendong Su. 2014. X-Force: Force-Executing Binary Programs for Security Applications. In 23rd USENIX Security Symposium (USENIX Security 14)."},{"key":"e_1_3_2_1_52_1","volume-title":"Black Hat USA","author":"Schenk Morten","year":"2017","unstructured":"Morten Schenk. 2017. Taking Windows 10 Kernel Exploitation to the Next Level -- Leveraging Write-What-Where Vulnerabilities in Creators Update. In Black Hat USA 2017."},{"key":"e_1_3_2_1_53_1","volume-title":"Black Hat Europe","author":"Sotirov Alexander","year":"2007","unstructured":"Alexander Sotirov. 2007. Heap Feng Shui in JavaScript. In Black Hat Europe 2007."},{"key":"e_1_3_2_1_54_1","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Stone Leo","year":"2023","unstructured":"Leo Stone, Rishi Ranjan, Stefan Nagy, and Matthew Hicks. 2023. No linux, no problem: fast and correct windows binary fuzzing via target-embedded snapshotting. In 32nd USENIX Security Symposium (USENIX Security 23). 4913--4929."},{"key":"e_1_3_2_1_55_1","volume-title":"Fuzzing: Brute Force Vulnerability Discovery","author":"Sutton Michael","year":"2007","unstructured":"Michael Sutton, Adam Greene, and Pedram Amini. 2007. Fuzzing: Brute Force Vulnerability Discovery. Addison-Wesley Professional."},{"key":"e_1_3_2_1_56_1","volume-title":"Black Hat USA","author":"Tomer Bar Peleg Hadar","year":"2020","unstructured":"Peleg Hadar Tomer Bar. 2020. A Decade After Stuxnet's Printer Vulnerability: Printing is Still the Stairway to Heaven. In Black Hat USA 2020."},{"unstructured":"untidy - XML Fuzzer 2024. untidy - XML Fuzzer. https:\/\/github.com\/kbandla\/python-untidy.","key":"e_1_3_2_1_57_1"},{"unstructured":"World Wide Web Consortium (W3C). 2012. W3C XML Schema Definition Language (XSD). https:\/\/www.w3.org\/TR\/xmlschema11--1\/.","key":"e_1_3_2_1_58_1"},{"doi-asserted-by":"publisher","key":"e_1_3_2_1_59_1","DOI":"10.1109\/SP54263.2024.00211"},{"unstructured":"Sally Junsong Wang Jianan Yao Kexin Pei Hidedaki Takahashi and Junfeng Yang. 2024. Detecting Buggy Contracts via Smart Testing. arXiv:2409.04597 [cs.SE] https:\/\/arxiv.org\/abs\/2409.04597","key":"e_1_3_2_1_60_1"},{"doi-asserted-by":"publisher","key":"e_1_3_2_1_61_1","DOI":"10.1145\/3650212.3680394"},{"doi-asserted-by":"publisher","key":"e_1_3_2_1_62_1","DOI":"10.1145\/3689736"},{"unstructured":"Chenyuan Yang Zijie Zhao and Lingming Zhang. 2024. KernelGPT: Enhanced Kernel Fuzzing via Large Language Models. arXiv:2401.00563 [cs.CR] https:\/\/arxiv.org\/abs\/2401.00563","key":"e_1_3_2_1_63_1"}],"event":{"sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"],"acronym":"CCS '25","name":"CCS '25: ACM SIGSAC Conference on Computer and Communications Security","location":"Taipei Taiwan"},"container-title":["Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3719027.3744807","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:08:05Z","timestamp":1766441285000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3719027.3744807"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,19]]},"references-count":63,"alternative-id":["10.1145\/3719027.3744807","10.1145\/3719027"],"URL":"https:\/\/doi.org\/10.1145\/3719027.3744807","relation":{},"subject":[],"published":{"date-parts":[[2025,11,19]]},"assertion":[{"value":"2025-11-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}