一句话：提出基于 agent 的框架 IntOAgent，将可达性与溢出触发解耦，实现可扩展的整数溢出漏洞检测与可触发 PoC 生成。
整数溢出是 C/C++ 中长期被低估的漏洞类别，现有方法因算术操作搜索空间庞大而扩展性不足，且难以生成可触发 PoC——必须同时满足语句可达性与溢出触发约束。IntOAgent 的核心思想是将可达性与溢出触发视为不同但协同的两个任务：用两阶段过滤剪除可证明安全的操作，用边界感知的路径优先排序聚焦易溢出路径；并通过推断输入结构、结合溢出导向的区间分析，在保持路径可行的前提下驱动输入越过边界。在 Juliet c 与 SQLite、Libxml2、Libplist、V8、Libpng 上同定向模糊测试及基于 LLM 的方法对比，效果与效率均更优，发现全部已知漏洞和 117 个未知整数溢出漏洞（68 个获 CVE 编号）。
Integer overflows remain a long-standing yet often underestimated class of vulnerabilities in C/C++ software, often leading to logic errors and severe downstream security consequences. Despite their simple arithmetic nature, accurately detecting integer overflows in real-world codebases remains challenging. Existing approaches suffer from poor scalability due to the large search space of arithmetic operations, and often fail to generate triggerable proof-of-concept (PoCs) because jointly satisfying statement reachability and overflow-triggering constraints is inherently difficult. In this paper, we propose IntOAgent, a scalable agent-based framework for automated detection and triggering of integer overflow vulnerabilities. IntOAgent is built on the key insight that reachability and overflow triggering should be treated as distinct yet coordinated tasks. To improve scalability, IntOAgent employs a two-stage filtering strategy to prune provably safe operations and a boundary-aware path prioritization to focus on overflow-prone executions. To enable effective PoC generation, IntOAgent infers input structures and integrates overflow-guided range analysis to drive inputs toward boundary violations while preserving path feasibility. We evaluate IntOAgent on established benchmarks Juliet c and five widely-used real-world projects (SQLite, Libxml2, Libplist, V8, and Libpng) against state-of-the-art directed fuzzing and LLM-based techniques. IntOAgent outperforms existing approaches in both effectiveness and efficiency, discovering all existing vulnerabilities and 117 previously unknown integer overflow vulnerabilities (68 assigned CVEs). These results demonstrate that IntOAgent enables scalable generation of triggerable PoCs, significantly improving the practical detection of integer overflow vulnerabilities.
@inproceedings{paperbot12473,
title = {IntOAgent: A Practical Framework for Automated Detection and Triggering of Integer Overflow Vulnerabilities},
author = {Yuelin Wang and Jiongchi Yu and Xiaofei Xie and Yaohui Sun and Tianyu Shi and Yanbang Sun and Qiang Hu and Junjie Wang},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834336}
}