Abstract:Existing large language model (LLM) agent based approaches to automated vulnerability report reproduction face several technical challenges, including limited information sources, insufficient attention to application runtime states, and difficulty in adapting to complex environments. To address these issues, this study proposes VulVerifier, an agent-based technique for automated vulnerability report reproduction. The proposed technique uses three key components. First, it integrates multiple information sources, such as vulnerability descriptions, source code repositories, and related documentation, to fill in and refine missing key information. Second, it uses automated interactions to guide the target application step by step into a prerequisite state for vulnerability triggering, thus improving the feasibility of vulnerability reproduction. Finally, during the reproduction execution, anomalies are dynamically detected and corrected in real time, thus enhancing adaptability to complex environments and improving the robustness of vulnerability reproduction. Experimental results on 86 real-world vulnerability reports show that VulVerifier achieves a reproduction success rate of 44.7%, which is close to the 66.3% success rate of human experts. Compared with the existing method, CVE-Genie, the proposed system successfully reproduces 34 additional vulnerability reports and reduces the average reproduction cost by 3.19 dollars.