一句话：提出 TACO-Fuzz，通过目标中心的种子选择与生成改进定向混合模糊测试，到达目标位置最高约 10 倍加速并发现 17 个新漏洞。
针对定向混合模糊测试中种子选择与生成效率低的问题，本文提出 TACO-Fuzz。它引入两阶段目标中心的种子选择策略，优先选择探索不足路径上的输入用于符号执行，并基于扩展路径条件的构造实现目标中心的种子生成，从而提升种子质量。作者在公开基准上评估，到达目标位置的平均加速最高接近 10 倍，在复现真实漏洞上也有相当提升；此外借助该方法发现了 17 个此前未知漏洞并获得 CVE 编号，多数情况下漏洞发现与复现更快。
Software vulnerabilities pose severe security threats, highlighting the need for effective automated detection. Directed hybrid fuzzing, which combines the rapid exploration of fuzz testing with the precise constraint solving of symbolic execution, has made notable advancements in vulnerability discovery. However, existing directed hybrid fuzzing approaches still face two key challenges: (1) inefficient seed selection, leading to inadequate prioritization of optimal inputs for symbolic execution, and (2) inefficient seed generation, resulting in suboptimal seed generation. To address these issues, we propose TACO-Fuzz, TArget-Centric cOncolic Fuzzing, which introduces a two-phase target-centric seed selection strategy to prioritize under-explored paths and a target-centric seed generation approach based on constructing extended path conditions, thereby improving seed quality. Our evaluation on a selected set of public benchmarks shows that TACO-Fuzz can outperform several representative state-of-the-art directed fuzzing tools, achieving up to an average speedup of nearly 10x in reaching target locations, along with comparable improvements in reproducing real-world vulnerabilities. Moreover, TACO-Fuzz contributed to the discovery of 17 previously unknown vulnerabilities, each assigned a CVE, and demonstrated faster vulnerability discovery and reproduction in most cases.
@article{paperbot3796,
title = {Efficient Directed Hybrid Fuzzing via Target-Centric Seed Selection and Generation},
author = {Zhen Li and Shenghan Liu and Qiuping Yi and Pengbo Du and Hongliang Liang},
journal = {Proceedings of the ACM on Programming Languages},
volume = {10},
number = {OOPSLA1},
year = {2026},
doi = {10.1145/3798233}
}