Making Vulnerability Proof-of-Concepts Trustworthy and Usable: From Empirical Diagnosis to Operational Validation

Abstract

Vulnerability Proof-of-Concepts (PoCs) are the executable evidence that a disclosed vulnerability is real and reachable, the artifact defenders use to suppress false positives, verify patches, delimit affected versions, and judge exploitability. Their value hinges not on whether a PoC exists but on whether it is usable: available, complete, correctly linked to a vulnerability record, and reproducible. That had never been measured. This thesis conducts the largest PoC study to date, covering 470K+ PoCs over 298K CVEs across 13 platforms, and finds an ecosystem that fails on all four counts. It is the first work to treat PoC usability as a first-class problem: a four-stage pipeline diagnoses the ecosystem, then repairs it by completing, linking, and cross-version validating PoCs. All four stages are implemented and evaluated, and every figure below is measured: agentic reproduction lifts directly reproducible PoCs from 28.0% to 78.7%; multi-source completion repairs incomplete reports at 91.3% accuracy; semantic link recovery restores severed PoC↔CVE links at 96.3% Recall@10; and static validation decides cross-version triggerability at 94.3% accuracy. Hundreds of the repaired artifacts have already been accepted by CNAs and platform maintainers into official CVE records, external confirmation beyond this thesis’s own evaluation.