ARVO: Atlas of Reproducible Vulnerabilities for Open Source Software

ARVO is a dataset of over 6,100 reproducible real-world vulnerabilities across 311 open-source projects, built by making the OSS-Fuzz vulnerability collection fully reproducible. The authors, including Xiang Mei and Brendan Dolan-Gavitt, argue that reproducibility has long been the most neglected dimension of vulnerability datasets, which limits automatic extraction and downstream security research. Each vulnerability can be consistently rebuilt, triggered, and analyzed across versions, which enables automatic identification of the corresponding patch. In the authors' evaluation, ARVO reproduces 81% of vulnerabilities and achieves 89.4% accuracy on the located patches.