Unlocking Patch Evolution Risks for Memory Safety: A Comprehensive Study

Abstract

Memory safety vulnerabilities have become a major threat to open-source software, accounting for more than 70% of publicly disclosed vulnerabilities over the past decade. Security patches are the primary way to eliminate memory safety risks, but their effectiveness often depends on precise boundary constraints, memory-size calculations, pointer validation, and numerical consistency. As code evolves, subsequent modifications to patched code may unintentionally weaken or invalidate the original repair logic, reintroducing security risks. However, existing patch evolution studies mainly focus on generic evolution patterns across different vulnerability types and pay limited attention to the domain-specific semantic sensitivity of memory safety patches. As a result, the evolution risks of memory safety patches remain insufficiently understood. To address this gap, this paper presents a systematic empirical study of patch evolution for memory safety vulnerabilities. We construct a high-quality evolution dataset covering nine representative memory safety vulnerability categories and design a multi-stage analysis framework to characterize patch evolution and identify semantic distortion risks. Specifically, we quantify the prevalence of patch evolution, analyze syntactic features and evolution patterns, and assess whether evolved patches preserve the original repair intent through a hybrid verification mechanism that combines manual semantic auditing with tool-assisted validation. Experimental results show that, within the analyzed subset, the direct patch modification rate reaches 82.1%, and 20.6% of the directly evolved CVEs exhibit semantic distortion. Among the identified distortion CVEs, patch code deletion (P13) is the dominant contributor, accounting for 72.7% of them. We also observe that numeric-related vulnerabilities, such as CWE-189, tend to exhibit higher semantic distortion risks in our dataset. Overall, this study reveals the evolution dynamics and risk distribution of memory safety patches, and provides empirical evidence and methodological guidance for full-lifecycle patch management in open-source projects.

Keywords

Vulnerability Analysis / Memory Safety / Security Patch / Code Evolution

Rights & permissions

Higher Education Press 2026

Just Accepted

This article has successfully passed peer review and final editorial review, and will soon enter typesetting, proofreading and other publishing processes. The currently displayed version is the accepted final manuscript. The officially published version will be updated with format, DOI and citation information upon launch. We recommend that you pay attention to subsequent journal notifications and preferentially cite the officially published version. Thank you for your support and cooperation.