My coauthors and I will be presenting the paper "PathGlow: SSE-Driven on-Demand Data-Flow Analysis for Detecting Path Traversal in Binaries" at the 2026 IEEE Conference on Dependable and Secure Computing (DSC) in October. Below is a preview of the abstract:

Taint-style vulnerabilities such as path traversal remain difficult to identify in deployed binaries, where generic taint analyses often report source-to-sink reachability without determining whether the path is actually protected by a correct sanitizer. This limitation produces many false positives and makes it difficult to distinguish exploitable CWE-22 vulnerabilities from benign or correctly patched cases. We present PathGlow, a static framework for CWE-22 detection in stripped Linux binaries. PathGlow combines Selective Symbolic Execution (SSE) to validate sanitizer behavior with on-demand interprocedural Reaching Definition Analysis (RDA) to recover source-to-sink flows and their relevant security context. Rather than exhaustively exploring program paths, PathGlow produces path-traversal-specific evidence by jointly reasoning about sanitizer correctness, taint reachability, and file-operation sink context. We evaluate PathGlow on 26 real-world programs and 3,600 synthetic binaries. PathGlow detects all known CWE-22 cases, identifies three previously unknown vulnerabilities caused by missing or flawed sanitization, reveals two incomplete patches, and reports only nine false positives. Compared with best-effort CWE-22 adaptations of contemporary existing tools Arbiter and Hermescan, whose conservative taint propagation frequently flags sanitized or benign flows, PathGlow provides stronger exploitability evidence for each reported finding. PathGlow analyzes stripped binaries from projects exceeding 845 KLoC without requiring source code, debug symbols, concrete inputs, dynamic execution, or application-specific knowledge.