{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T19:43:27Z","timestamp":1782848607205,"version":"3.54.5"},"reference-count":56,"publisher":"Association for Computing Machinery (ACM)","issue":"FSE","license":[{"start":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T00:00:00Z","timestamp":1782777600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Proc. ACM Softw. Eng."],"published-print":{"date-parts":[[2026,6,30]]},"abstract":"<jats:p>We study how security patches in highly configurable C\/C++ systems map onto the space of compile-time  \nvariants. We formalize the Vulnerability Impact Condition (VIC)\u2014a Boolean predicate over configuration  \noptions that denotes all variants that contained the original flaw\u2014and introduce PatchLens, a purely static  \ntechnique that recovers VICs by aligning AST-level patch hunks with source-level presence conditions and  \nresolving file inclusion via lightweight build system analysis. Evaluating PatchLens on 1,192 Linux kernel,  \n289 FFmpeg, and 100 PHP patches, we compute precise, human-readable VICs without the need to compile  \nany system variant. The resulting predicates are compact (avg. 1.84 variables for Linux, 3.23 for FFmpeg, 1.04  \nfor PHP) and show that only a small fraction of vulnerabilities are system-wide, which carry higher CVSS  \nscores; meanwhile, CVE texts almost never encode the required options (\u22481% average recall), motivating  \nautomated enrichment of CVE descriptions with VICs. PatchLens and the accompanying dataset enable  \nimmediate applications in CI (variant-aware triage and test selection), targeted sampling and fuzzing, and  \nfeature risk scoring, offering a scalable, explainable path to vulnerability assessment in highly configurable  \nsoftware.<\/jats:p>","DOI":"10.1145\/3808126","type":"journal-article","created":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T17:06:14Z","timestamp":1782839174000},"page":"2675-2697","source":"Crossref","is-referenced-by-count":0,"title":["Automated Detection of Configuration-Specific Security Vulnerabilities via Patch Analysis"],"prefix":"10.1145","volume":"3","author":[{"ORCID":"https:\/\/2.zoppoz.workers.dev:443\/https\/orcid.org\/0009-0009-7370-5478","authenticated-orcid":false,"given":"Felipe de Sant'Anna","family":"Paix\u00e3o","sequence":"first","affiliation":[{"name":"Federal University of Bahia, Salvador, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/2.zoppoz.workers.dev:443\/https\/orcid.org\/0000-0001-8743-2516","authenticated-orcid":false,"given":"Joanna C. S.","family":"Santos","sequence":"additional","affiliation":[{"name":"University of Notre Dame, Notre Dame, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/2.zoppoz.workers.dev:443\/https\/orcid.org\/0000-0003-0197-8249","authenticated-orcid":false,"given":"Paulo Anselmo da Mota Silveira","family":"Neto","sequence":"additional","affiliation":[{"name":"Federal Rural University of Pernambuco, Recife, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/2.zoppoz.workers.dev:443\/https\/orcid.org\/0000-0002-8953-4003","authenticated-orcid":false,"given":"Daniel Sadoc","family":"Menasche","sequence":"additional","affiliation":[{"name":"Federal University of Rio de Janeiro, Rio de Janeiro, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/2.zoppoz.workers.dev:443\/https\/orcid.org\/0000-0001-9756-378X","authenticated-orcid":false,"given":"Gustavo Bittencourt","family":"Figueiredo","sequence":"additional","affiliation":[{"name":"Federal University of Bahia, Salvador, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/2.zoppoz.workers.dev:443\/https\/orcid.org\/0000-0002-9312-6715","authenticated-orcid":false,"given":"Eduardo Santana","family":"de Almeida","sequence":"additional","affiliation":[{"name":"Federal University of Bahia, Salvador, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,6,30]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/2642937.2642990"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/3170492.3136051"},{"key":"e_1_2_1_3_1","volume-title":"Strategies for Product-Line Verification: Case Studies and Experiments. ICSE '13","author":"Apel Sven","year":"2013","unstructured":"Sven Apel, Alexander von Rhein, Philipp Wendler, Armin Gr\u00f6\u00dflinger, and Dirk Beyer. 2013. Strategies for Product-Line Verification: Case Studies and Experiments. ICSE '13. (2013)."},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510113"},{"key":"e_1_2_1_5_1","first-page":"7","article-title":"Feature Models, Grammars, and Propositional Formulas. In Software Product Lines, Henk Obbink and Klaus Pohl (Eds.)","author":"Batory Don","year":"2005","unstructured":"Don Batory. 2005. Feature Models, Grammars, and Propositional Formulas. In Software Product Lines, Henk Obbink and Klaus Pohl (Eds.). Springer Berlin Heidelberg, 7-20.","journal-title":"Springer Berlin Heidelberg"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.is.2010.01.001"},{"key":"e_1_2_1_7_1","unstructured":"Thorsten Berger and Steven She. 2012. Google Code Project: various variability extraction and analysis tools. http: \/\/code.google.com\/p\/variability\/ Visited on 2025-06-12."},{"key":"e_1_2_1_8_1","unstructured":"Harold Booth. 2015. National Vulnerability Database. https:\/\/2.zoppoz.workers.dev:443\/https\/nvd.nist.gov\/ Accessed: 2025-06-30."},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jcss.2010.06.011"},{"key":"e_1_2_1_10_1","unstructured":"The Kernel Development Community. 2018. KConfig Language. https:\/\/2.zoppoz.workers.dev:443\/https\/www.kernel.org\/doc\/html\/latest\/kbuild\/kconfiglanguage.html. Accessed: 2024-01-30."},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-78800-3_24"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/2362536.2362544"},{"key":"e_1_2_1_13_1","first-page":"475","volume-title":"Proc. 2014 Conference on Internet Measurement Conference","author":"Durumeric","unstructured":"Durumeric, Zakir et al. 2014. The Matter of Heartbleed. In Proc. 2014 Conference on Internet Measurement Conference (Vancouver, BC, Canada) (IMC '14). ACM, New York, NY, USA, 475-488."},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2002.1158288"},{"key":"e_1_2_1_15_1","volume-title":"ICSM '05","author":"Garrido Alejandra","year":"2005","unstructured":"Alejandra Garrido and Ralph Johnson. 2005. Analyzing Multiple Configurations of a C Program. ICSM '05. (2005)."},{"key":"e_1_2_1_16_1","volume-title":"Feature Interaction Faults Revisited: An Exploratory Study. ISSRE '11","author":"Brady","year":"2011","unstructured":"Brady J. Garvin and Myra B. Cohen. 2011. Feature Interaction Faults Revisited: An Exploratory Study. ISSRE '11. (2011)."},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/3106237.3106283"},{"key":"e_1_2_1_18_1","volume-title":"PLDI'12","author":"Gazzillo Paul","year":"2012","unstructured":"Paul Gazzillo and Robert Grimm. 2012. SuperC: Parsing All of C by Taming the Preprocessor. PLDI'12. (2012)."},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3233027.3236404"},{"key":"e_1_2_1_20_1","unstructured":"GNU Project. 2017. M4 Macro Language. https:\/\/2.zoppoz.workers.dev:443\/https\/www.gnu.org\/software\/m4\/m4.html Accessed: 2025-07-15."},{"key":"e_1_2_1_21_1","unstructured":"GNU Project. 2025. Unified Diff Format. GNU Diffutils Manual version 3.12 section 2.2.2. https:\/\/2.zoppoz.workers.dev:443\/https\/www.gnu.org\/ software\/diffutils\/manual\/html_node\/Unified-Format.html Accessed: 2025-07-15."},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/3634713.3634719"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.5591\/978-1-57735-516-8\/IJCAI11-102"},{"key":"e_1_2_1_24_1","article-title":"Understanding Vulnerability Inducing Commits of the Linux Kernel","volume":"33","author":"Jiang Muhui","year":"2024","unstructured":"Muhui Jiang, Jinan Jiang, Tao Wu, Zuchao Ma, Xiapu Luo, and Yajin Zhou. 2024. Understanding Vulnerability Inducing Commits of the Linux Kernel. ACM Transactions on Software Engineering and Methodology 33, 7 (2024), 170:1-170:31.","journal-title":"ACM Transactions on Software Engineering and Methodology"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/2362536.2362547"},{"key":"e_1_2_1_26_1","doi-asserted-by":"crossref","unstructured":"Kyo Kang Sholom Cohen James Hess William Novak and A. Peterson. 1990. Feature-Oriented Domain Analysis (FODA) feasibility study. (01 1990).","DOI":"10.21236\/ADA235785"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/2048066.2048128"},{"key":"e_1_2_1_28_1","first-page":"25","article-title":"TypeChef: toward type checking #ifdef variability in C. In FOSD (Eindhoven, The Netherlands). ACM, New York","author":"Kenner Andy","year":"2010","unstructured":"Andy Kenner, Christian K\u00e4stner, Steffen Haase, and Thomas Leich. 2010. TypeChef: toward type checking #ifdef variability in C. In FOSD (Eindhoven, The Netherlands). ACM, New York, NY, USA, 25-32.","journal-title":"NY, USA"},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00002"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3233027.3236399"},{"key":"e_1_2_1_31_1","volume-title":"FeatureIDE: A Tool Framework for Feature-Oriented Software Development. SPLC '09","author":"K\u00e4stner Christian","year":"2009","unstructured":"Christian K\u00e4stner, Thomas Th\u00fcm, Gunter Saake, Janet Feigenspan, Thomas Leich, Fabian Wielgorz, and Sven Apel. 2009. FeatureIDE: A Tool Framework for Feature-Oriented Software Development. SPLC '09. (2009)."},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/3646548.3672585"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSTE61649.2023.00009"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/1806799"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/1960275.1960299"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/2491411.2491437"},{"key":"e_1_2_1_37_1","volume-title":"ICSE '16","author":"Medeiros Fl\u00e1vio","year":"2016","unstructured":"Fl\u00e1vio Medeiros, Christian K\u00e4stner, M\u00e1rcio Ribeiro, Rohit Gheyi, and Sven Apel. 2016. A Comparison of 10 Sampling Algorithms for Configurable Systems. ICSE '16. (2016)."},{"key":"e_1_2_1_38_1","volume-title":"The Love\/Hate Relationship with the C Preprocessor: An Interview Study. ECOOP'15","author":"Medeiros Fl\u00e1vio","year":"2015","unstructured":"Fl\u00e1vio Medeiros, Christian K\u00e4stner, M\u00e1rcio Ribeiro, Sarah Nadi, and Rohit Gheyi. 2015. The Love\/Hate Relationship with the C Preprocessor: An Interview Study. ECOOP'15. (2015)."},{"key":"e_1_2_1_39_1","volume-title":"Investigating Preprocessor-Based Syntax Errors. GPCE '13","author":"Medeiros Fl\u00e1vio","year":"2013","unstructured":"Fl\u00e1vio Medeiros, M\u00e1rcio Ribeiro, et al. 2013. Investigating Preprocessor-Based Syntax Errors. GPCE '13. (2013)."},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/2970276.2970322"},{"key":"e_1_2_1_41_1","first-page":"231","article-title":"SAT-based analysis of feature models is easy","author":"Mendon\u00e7a Marc\u00edlio","year":"2009","unstructured":"Marc\u00edlio Mendon\u00e7a, Andrzej Wasowski, and Krzysztof Czarnecki. 2009. SAT-based analysis of feature models is easy. SPLC, 231-240.","journal-title":"SPLC"},{"key":"e_1_2_1_42_1","unstructured":"NIST. 2015. Official Common Platform Enumeration Dictionary. https:\/\/2.zoppoz.workers.dev:443\/https\/nvd.nist.gov\/products\/cpe"},{"key":"e_1_2_1_43_1","unstructured":"Felipe Paix\u00e3o. [n. d.]."},{"key":"e_1_2_1_44_1","unstructured":"Patchlens Repository. https:\/\/2.zoppoz.workers.dev:443\/https\/github.com\/fleap-dev\/patchlens. n. d.."},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","unstructured":"Felipe Paix\u00e3o. 2026. Patchlens Artifacts. doi:10.5281\/zenodo.19560745 10.5281\/zenodo.19560745","DOI":"10.5281\/zenodo.19560745"},{"key":"e_1_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICST.2010.43"},{"key":"e_1_2_1_47_1","unstructured":"Matthew Prince. 2014. The Hidden Costs of Heartbleed. https:\/\/2.zoppoz.workers.dev:443\/https\/blog.cloudflare.com\/the-hard-costs-of-heartbleed\/"},{"key":"e_1_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-021-09944-w"},{"key":"e_1_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1109\/32.536955"},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/1966445.1966451"},{"key":"e_1_2_1_51_1","volume-title":"USENIX ATC '14","author":"Tartler Reinhard","year":"2014","unstructured":"Reinhard Tartler, Christian Dietrich, Julio Sincero, Wolfgang Schr\u00f6der-Preikschat, and Daniel Lohmann. 2014. Static Analysis of Variability in System Software: The 90,000 #ifdefs Issue. USENIX ATC '14. (2014)."},{"key":"e_1_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1145\/2039239.2039242"},{"key":"e_1_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2015.39"},{"key":"e_1_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN48987.2021.00030"},{"key":"e_1_2_1_55_1","volume-title":"Proc. ACM Softw. Eng. 1, FSE, Article 20 (July","year":"2024","unstructured":"Y\u0131ld\u0131ran, Necip Faz\u0131l et al. 2024. Maximizing Patch Coverage for Testing of Highly-Configurable Software without Exploding Build Times. Proc. ACM Softw. Eng. 1, FSE, Article 20 (July 2024)."},{"key":"e_1_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1145\/1644893.1644896"}],"container-title":["Proceedings of the ACM on Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/dl.acm.org\/doi\/pdf\/10.1145\/3808126","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T18:44:22Z","timestamp":1782845062000},"score":1,"resource":{"primary":{"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/dl.acm.org\/doi\/10.1145\/3808126"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,30]]},"references-count":56,"journal-issue":{"issue":"FSE","published-print":{"date-parts":[[2026,6,30]]}},"alternative-id":["10.1145\/3808126"],"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/doi.org\/10.1145\/3808126","relation":{},"ISSN":["2994-970X"],"issn-type":[{"value":"2994-970X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,30]]}}}