The History Is the Detector: Executing CVE Patch History, End-to-End
BUGSTONE-E2E turns verified CVE fix commits into executable rules, then checks suspected bugs with runtime evidence and patch tests.
The paper says the system mined 2,710 fixing commits from 19,325 high-severity CVEs dated 2022 to 2026. It built 1,033 rules across 56 CWE families, packaged as 172 skills. Its pipeline narrows candidates from Tree-sitter call-site matches through heuristics, LLM inspection, re-triage, runtime verification, and differential patch testing. Across 14 programs, it produced runtime evidence for 644 findings. ArXiv · AI/CL/LG's note
The paper says the system mined 2,710 fixing commits from 19,325 high-severity CVEs dated 2022 to 2026. It built 1,033 rules across 56 CWE families, packaged as 172 skills. Its pipeline narrows candidates from Tree-sitter call-site matches through heuristics, LLM inspection, re-triage, runtime verification, and differential patch testing. Across 14 programs, it produced runtime evidence for 644 findings. ArXiv · AI/CL/LG's note
score 5