From Description to Score: Can LLMs Quantify Vulnerabilities?

2025-12-07 · Sima Jafarikhah, Daniel Thompson, Eva Deans, Hossein Siadati, Yi Liu arxiv

Manual vulnerability scoring, such as assigning Common Vulnerability Scoring System (CVSS) scores, is a resource-intensive process that is often influenced by subjective interpretation. This study investigates the potential of general-purpose large language models (LLMs), namely ChatGPT, Llama, Grok, DeepSeek, and Gemini, to automate this process by analyzing over 31{,}000 recent Common Vulnerabilities and Exposures (CVE) entries. The results show that LLMs substantially outperform the baseline on certain metrics (e.g., \textit{Availability Impact}), while offering more modest gains on others (e.g., \textit{Attack Complexity}). Moreover, model performance varies across both LLM families and individual CVSS metrics, with ChatGPT-5 attaining the highest precision. Our analysis reveals that LLMs tend to misclassify many of the same CVEs, and ensemble-based meta-classifiers only marginally improve performance. Further examination shows that CVE descriptions often lack critical context or contain ambiguous phrasing, which contributes to systematic misclassifications. These findings underscore the importance of enhancing vulnerability descriptions and incorporating richer contextual details to support more reliable automated reasoning and alleviate the growing backlog of CVEs awaiting triage.

📄 PDF Abstract BibTeX arXiv:2512.06781

Code (0)

등록된 구현이 없습니다.

Can LLM Prompting Serve as a Proxy for Static Analysis in Vulnerability Detection

2024-12-16 · Ira Ceka, Feitong Qiao, Anik Dey, Aastha Valecha 외

Despite their remarkable success, large language models (LLMs) have shown limited ability on applied tasks such as vulnerability detection. We investigate various prompting strategies for vulnerability detection and, as …

Vulnerability Detection

LLM Agents can Autonomously Exploit One-day Vulnerabilities

2024-04-11 · Richard Fang, Rohan Bindu, Akul Gupta, Daniel Kang

LLMs have becoming increasingly powerful, both in their benign and malicious uses. With the increase in capabilities, researchers have been increasingly interested in their ability to exploit cybersecurity vulnerabilitie…

Evaluating Open-Weight LLMs for Generating Structured Threat Information for Autonomous Vehicle Vulnerabilities

2026-07-17 · Md Erfan, Ahmed Ryan, Md Kamal Hossain Chowdhury, Md Rayhanur Rahman arxiv

Connected and Autonomous Vehicles (CAVs) rely on interconnected software and hardware components, including sensors, Electronic Control Units, in-vehicle infotainment systems, and telematics units, where vulnerabilities …

Autonomous Vehicles

Software Vulnerability and Functionality Assessment using LLMs

2024-03-13 · Rasmus Ingemann Tuffveson Jensen, Vali Tawosi, Salwa Alamir

While code review is central to the software development process, it can be tedious and expensive to carry out. In this paper, we investigate whether and how Large Language Models (LLMs) can aid with code reviews. Our in…

Code Generation HumanEval mbpp

From Attack Descriptions to Vulnerabilities: A Sentence Transformer-Based Approach

2025-09-02 · Refat Othman, Diaeddin Rimawi, Bruno Rossi, Barbara Russo arxiv

In the domain of security, vulnerabilities frequently remain undetected even after their exploitation. In this work, vulnerabilities refer to publicly disclosed flaws documented in Common Vulnerabilities and Exposures (C…