Spatial memory corruptions remain among the most prevalent software vulnerabilities, consistently ranking among the top CWE categories. These vulnerabilities are closely tied to the values processed by the program: when input-derived values fall outside expected ranges, memory operations may be performed beyond their allocated bounds, leading to corruption. Our pilot study on 132 realworld CVEs shows that 72.7% of spatial memory corruptions stem from such valid value violations. Although fuzzing is widely used to expose exploitable memory corruptions, systematically detecting spatial memory corruptions through fuzzing remains challenging, as it requires generating inputs that conform to complex structural formats while violating valid value ranges. Recent work leverages LLMs to generate structured inputs based on format knowledge, yet LLMs exhibit a strong bias toward well-formed outputs, leaving systematic range violations largely unexplored. In this paper, we propose RamFuzz, an approach that exploits rather than mitigates this bias to guide the fuzzing process. RamFuzz prompts LLMs to enumerate valid ranges of target file formats and deliberately assigns invalid values to seeds during fuzzing, systematically triggering spatial memory corruptions. We evaluated RamFuzz on 15 popular real-world projects with more than 1,000 stars on GitHub, RamFuzz discovered 104 previously unknown memory corruptions, of which 39 have been confirmed, and 33 have been fixed by developers.

@inproceedings{paperbot12618,
  title = {RamFuzz: LLM-Guided Greybox Fuzzing for Spatial Memory Corruption via Valid Range Violation},
  author = {Shangzhi Xu and Wei Song and Yuekang Li and Nan Sun and Muhammad Ejaz Ahmed and Willy Susilo and Benjamin Turnbull and Xiao Cheng and Siqi Ma},
  booktitle = {ASE},
  year = {2026},
  doi = {10.1145/3832783.3837447}
}