Towards Early Warning of Real-World Vulnerabilities: An Evidence-Aware Decoupled Method for CVSS Vector Prediction Based on Unstructured Disclosures

1

Towards Early Warning of Real-World Vulnerabilities: An Evidence-Aware Decoupled Method for CVSS Vector Prediction Based on Unstructured Disclosures

arXiv:2611.06477v1 [cs.CR] 4 Nov 2026

Jianhong Ma, Wenhao Li, Xixing Li, Chenyu Yan, and Haowen Chen

✦

This work has been submitted to the IEEE for possible publication. Copyright may be transferred without notice, after which this version may no longer be accessible. Abstract—Early assessment of Common Vulnerability Scoring System (CVSS) vectors from Open Source Intelligence (OSINT) can reduce the delay between initial public disclosure and official National Vulnerability Database (NVD) scoring. Existing predictors, trained mainly on standardized late-stage descriptions, degrade on noisy and incomplete preNVD reports. We introduce PARSE, a vulnerability-disclosure lifecycle model, and VPre, an early assessment framework built on two-level Evidence-Aware Decoupling. Decoupling Level I, Security-Evidence Screening, separates security-relevant evidence from noisy early reports at the report and sentence levels. Decoupling Level II, EvidenceMatched Routing, decouples the prediction task of the eight CVSS metrics into a scattered-evidence class and an explicit-evidence class based on validation-set measurements, matching each with a targeted predictor: large-language-model reasoning for the former, lightweight supervised classification for the latter. On the 851-report held-out test split of the 5,581-report VPre-Bench, VPre achieves a mean absolute error of 0.7239—44.7% below the reproduced BERT-Small-NVD earlytransfer baseline; paired timestamps across the full benchmark show an average 38-day lead before official scoring (observed range 21–60 days). Under the 38:1 PARSE-Triage noise setting, STDU’s report-level screening reaches 0.98 precision, 1.00 recall, and 0.99 F1. Controlled ablations support the contributions of both decoupling levels. Index Terms—CVSS prediction, vulnerability assessment, open-source intelligence, evidence-aware decoupling, early warning.

1

I NTRODUCTION

The volume of publicly disclosed vulnerabilities has increased rapidly, while the manual analysis and scoring processes of the National Vulnerability Database (NVD) have struggled to keep pace [15], [16]. Published CVE • • • •

J. Ma and W. Li are with the School of Cyber Science and Engineering, Zhengzhou University, Zhengzhou, China. E-mail: majianhong@zzu.edu.cn and liuniu467@gmail.com. X. Li, C. Yan, and H. Chen are with Information Engineering University, Zhengzhou, China. E-mail: scholar_xx@whu.edu.cn, yan_cyu@163.com, and hwc_zzu@126.com. X. Li is also with the Key Laboratory of Cyberspace Security, Ministry of Education of China. Corresponding author: Xixing Li (scholar_xx@whu.edu.cn).

Records increased by 38.4% in 2024, while only 6.6% of the CVEs added during the February–May NVD processing slowdown had been analyzed [73], [74]. More importantly, a substantial delay often separates the initial public discussion of a vulnerability from the publication of its official NVD assessment. During this interval, issue trackers, mailing lists, bug reports, and vulnerability disclosure platforms may already contain evidence about attack conditions and security impact, even though no standardized description or official CVSS score is available. This creates an important early-warning opportunity: Can CVSS vectors and base scores be reliably estimated from early, unstructured OSINT before CVE assignment and NVD standardization? Our objective is to perform this prediction in the Pre-T0 stage and to quantify how much earlier the resulting estimates can be produced than official NVD scoring. Most existing automated CVSS prediction methods are trained and evaluated on standardized NVD descriptions, in which vulnerabilities have already been confirmed and their security properties are expressed in concise, expertauthored language [20], [21], [24], [31], [52], [66]. Early OSINT belongs to a fundamentally different information regime: before T0 , no CVE identifier or standardized description is available, and the evidence remains incomplete, uncertain, and highly unstructured [7], [9]. This difference directly affects the reliability of cross-phase prediction. In our reproduced cross-phase evaluation, BERT-Small-NVD achieves an MAE of 0.8918 on standardized NVD descriptions but degrades to 1.3095 when directly transferred to early OSINT, corresponding to a 47% increase in prediction error. Early CVSS forecasting is therefore not simply a matter of moving existing methods to an earlier stage; it constitutes a distinct prediction task under a different information regime. To formalize this temporal and informational mismatch, we introduce the PARSE vulnerability disclosure lifecycle: P (Probing), which occurs before T0 and captures the discovery of a bug or anomaly in highly unstructured text; A (Acknowledgment), which extends through the Pre-T0 reporting and confirmation process to T0 ; R (Reservation), which spans T0 –T1 after a CVE identifier is assigned; S (Standardization), which progresses through

2

T1 –T2 –T3 , with disclosure, description standardization, and final scoring as successive milestones; and E (Evaluation), which begins after T3 , when the finalized NVD description and official CVSS score are available for downstream evaluation. PARSE provides a unified basis for specifying when prediction occurs and what information is available at that point. VPre targets the P/A phases before T0 , whereas most existing CVSS prediction methods operate in the later S/E regime after vulnerability confirmation and description standardization. After locating our work within the PARSE lifecycle, we identify three interconnected challenges in early forecasting. First, cross-phase semantic drift: standardized NVD descriptions are concise and conclusive, whereas Pre-T0 OSINT is incomplete, uncertain, and highly unstructured, making feature mappings learned from late-stage text unreliable on early reports [17]. Second, security-evidence dilution: early OSINT is characterized by a mixture of genuine vulnerability reports and non-security bugs; moreover, even valid vulnerability reports contain substantial content unrelated to CVSS assessment [5], [50], [51], [65]. Third, heterogeneous requirements across CVSS metrics: the eight CVSS v3.1 Base metrics—AV, AC, PR, UI, S, C, I, and A—differ substantially in their evidence characteristics and reasoning requirements, so that a uniform predictor is unlikely to serve all dimensions equally well [13], [37]. Treating all eight metrics as a single prediction problem therefore forces a uniform model to handle qualitatively different forms of evidence, making reliable prediction across all dimensions difficult. Together, these observations show that early CVSS forecasting differs from late-stage prediction at the disclosure, input-evidence, and prediction-target levels. The core idea of VPre is to first isolate security-relevant evidence from noisy early reports and then decouple the prediction of the eight CVSS Base metrics according to their evidence characteristics and reasoning requirements. We refer to this two-level design as Evidence-Aware Decoupling. At the first level, Security-Evidence Screening decouples evidence preparation from CVSS prediction through report-level triage and sentence-level filtering; at the second, validation-derived evidence density decouples a uniform eight-metric predictor into two specialized prediction routes. First, VPre is designed for early P/A-stage OSINT rather than directly transferring a model trained on late-stage NVD descriptions. Second, the first level, Security-Evidence Screening, performs report-level security triage and sentence-level VT/CP/O screening, removing irrelevant content before prediction. Third, VPre uses the dimension-level evidence-density function D(m) on validation data to establish a fixed SER/EEC routing table for the eight CVSS Base metrics. Under this routing, AV/AC/PR/UI are assigned to the Scattered-Evidence Reasoner (SER), which uses LLMs for dimensions whose evidence is scattered and implicit in early reports, whereas S/C/I/A are assigned to the Explicit-Evidence Classifier (EEC), which uses a fine-tuned lightweight model for dimensions with stable lexical patterns. The routing table is derived once from the validation set and reused throughout inference rather than being recomputed for each report. VPre therefore executes a two-stage pipeline comprising three modules: the Semantic Triage and Denoising Unit

(STDU) first performs triage and denoising, after which SER and EEC conduct parallel decoupled prediction and produce the complete CVSS v3.1 vector and base score. To comprehensively evaluate VPre, our evaluation addresses three questions central to practical early warning: prediction accuracy on early OSINT, screening reliability in high-noise OSINT streams, and the effectiveness of SER/EEC specialization within Evidence-Aware Decoupling on the held-out test set. First, on VPre-Bench, which contains early OSINT matched to 5,581 real-world vulnerabilities, we compare VPre with directly transferred SOTA methods under the same early-OSINT setting to assess its prediction accuracy. Second, to approximate real-world deployment, we place VPre in the high-noise OSINT stream represented by PARSE-Triage, where non-security reports outnumber genuine vulnerabilities by approximately 38:1, and test whether it can reliably identify valid vulnerabilities before prediction. Third, under the same STDU-filtered input, we compare the fixed SER/EEC split with SER-only and EEC-only predictors to evaluate the metric-wise decoupling design. The results show that VPre achieves an MAE of 0.7239 on the 851-report held-out test set, reducing MAE by 44.7% relative to the reproduced BERT-Small-NVD earlytransfer baseline, while producing estimates an average of 38 days before official scoring. Under the high-noise setting, STDU’s report-level screening achieves a Precision of 0.98, a Recall of 1.00, and an F1 score of 0.99; the complete VPre framework also consistently outperforms the unified SERonly and EEC-only alternatives. The main contributions of this paper are as follows.

1)

2)

3)

4)

PARSE Lifecycle and Early-Forecasting Formulation: We formalize the semantic and informational evolution of vulnerability disclosures and define Pre-T0 CVSS prediction as a distinct early-warning task with explicit temporal and input boundaries. Complementary Benchmark Resources: We construct and publicly release PARSE-Triage for highnoise vulnerability triage and VPre-Bench for temporally controlled early-report/CVSS evaluation. Evidence-Aware Decoupling: We propose VPre with two explicit levels: Decoupling Level I, Security-Evidence Screening, separates evidence preparation from prediction through report- and sentence-level screening; Decoupling Level II, Evidence-Matched Routing, uses validation-derived evidence density to divide a uniform eight-metric predictor into specialized SER/EEC routes. Early-Regime Empirical Validation: Through matched early-OSINT comparisons, high-noise triage experiments, and module ablations, we show that VPre achieves an MAE of 0.7239 on the 851report held-out test set, reduces MAE by 44.7% relative to the reproduced BERT-Small-NVD earlytransfer baseline, and produces CVSS estimates an average of 38 days before official scoring based on paired VPre-Bench timestamps, with an observed range of 21–60 days.

3

2

R ELATED W ORK

2.1

Deep Learning for Automated CVSS Prediction

Early work by Spanos and Angelis [52] used multi-target regression with TF-IDF features to estimate vulnerability severity, providing an early data-driven approach to CVSS prediction. Related studies also examined machinelearning-based severity assessment and context-aware CVSS prioritization [46], [53], [54]. Kühn et al. [20] fine-tuned BERT-Small, DistilBERT, and BERT-Medium on NVD descriptions to predict the eight CVSS v3.1 metrics as supervised classification tasks. BERTSmall achieved an MAE(Mean Absolute Error) of 0.8918 and offered the best balance between prediction accuracy and model size in their study. These results show that fine-tuned language models can learn useful links between vulnerability descriptions and CVSS metrics. AutoCVSS [66] later provided a broad comparison of supervised CVSS prediction models. Its results include an MAE of 0.5490 for CVEDrill, 0.5540 for ModernBERT, and 0.7620 for DistilBERT-E. However, these models were trained and evaluated mainly on standardized descriptions of confirmed vulnerabilities from NVD. Their performance on incomplete and less structured early information therefore remains less clear. 2.2

LLMs for Automated CVSS Prediction

Recent studies have examined whether LLMs can predict CVSS metrics directly from vulnerability descriptions. Liu et al. [4] evaluated ChatGPT across several vulnerabilitymanagement tasks, including severity assessment, and showed that step-by-step prompting can support security reasoning. Isogai et al. [68] compared GPT-4o-mini with fine-tuned BERT models for CVSS base-vector prediction and found that BERT performed better on most metrics. AutoCVSS [66] compared supervised models with several generative models under the same evaluation setting. GPT-4o with 24 examples achieved an MAE of 0.6080, while the supervised models produced lower errors when enough labeled data were available. The study also showed that LLMs remain useful in zero-shot and few-shot settings where labeled examples are limited. KBS 2025 [31] presented a hybrid method in which GPT-3.5-Turbo first rewrites a vulnerability description into a more standard form and BERT-Small then predicts the CVSS vector. The method reported an MAE of 0.166 and an MSE(Mean Squared Error) of 0.299 on NVD data, showing that LLM-based text processing can be combined with a smaller prediction model. Marchiori et al. [37] compared seven LLMs with three embedding models combined with XGBoost for individual CVSS metrics. They found that LLMs performed better on AV and AC, while the embedding-based models performed better on C, I, and A. These findings suggest that LLMs and supervised models have different strengths and that one model may not be the best choice for every CVSS metric. 2.3

Early Vulnerability Intelligence and Report Triage

Early vulnerability intelligence refers to public information that appears before formal vulnerability descriptions and

scores are available. Earlier studies showed that public signals can support exploit prediction and vulnerability prioritization [9], [10]. Other studies found that vulnerability discovery and disclosure can involve several project sources, such as issue reports and code changes [14]. One related research line focuses on separating securityrelated reports from ordinary software bugs. Peters et al. [69] proposed FARSEC, which filters and ranks bug reports while handling class imbalance and security words that may also appear in non-security reports. Ghosh et al. [70] analyzed 10.9 million GitHub issues from npm projects and trained text classifiers to identify security-related issues without clear security labels. These studies show that report triage is important because early public reports can contain both security issues and ordinary bugs. Liu et al. [71] studied 21,501 vulnerabilities linked to open-source projects and found that 41.66% had related GitHub issues before formal disclosure, with a median lead time of 39 days. This result confirms that public project discussions can provide useful early information. However, early reports do not always have reliable labels. Wu et al. [72] examined five public security-bug-report datasets and found 749 security reports that had been incorrectly labeled as non-security reports. They also showed that correcting these labels changed the measured performance of prediction models. VLAI [67] represents another form of early assessment by predicting severity categories before an official CVSS score is published. It uses descriptions that already refer to vulnerabilities and predicts a severity category rather than the full CVSS vector. Overall, current studies address early report triage and early severity assessment as mostly separate tasks. 2.4

Research Gap and Motivation

The studies above reveal three main gaps. First, most deeplearning CVSS models are trained and tested on standardized descriptions of confirmed vulnerabilities, so their reliability on early intelligence remains uncertain. Second, LLMs can support text understanding and reasoning, but they do not consistently outperform supervised models across all CVSS metrics. Third, early-intelligence studies have mainly focused on finding security-related reports, while CVSS prediction studies usually assume that the input is already a confirmed vulnerability. These gaps show the need for reliable CVSS prediction from early intelligence that may be incomplete, unstructured, or mixed with ordinary software bugs. They also suggest that report triage, text preparation, and the different characteristics of CVSS metrics should be considered together.

3 PARSE L IFECYCLE F OUNDATION

AND

M ETHODOLOGY

This section develops the methodological foundation of VPre. It proceeds in three layers. § 3.1 fixes the temporal and informational boundary of our task by introducing the PARSE vulnerability disclosure lifecycle and anchoring its five phases to four verifiable time nodes. § 3.2 then locates

4

TABLE 1 PARSE lifecycle phases and security events. PARSE Phase

Temporal Scope

Core Security Event

P - Probing A - Acknowledgment R - Reservation S - Standardization E - Evaluation

Before T0 Pre-T0 to T0 T0 –T1 T1 –T2 –T3 After T3

Researchers/attackers discover a bug or anomaly Vendor receives the report, reproduces the issue, and confirms its security relevance A CVE ID is assigned at T0 ; the embargo remains in effect until T1 OSINT emerges at T1 ; the NVD description is standardized at T2 and finalized with official scoring at T3 Finalized NVD descriptions and CVSS scores become available for downstream evaluation

TABLE 2 Temporal landmarks and available data states. Time Node

Event

Data State

T0 (Embargo) T1 (Embargo ends) T2 (Days/months post-T1 ) T3 (Days/weeks post-T2 )

CNA assigns CVE ID Vulnerability details disclosed; NVD publishes initial description NVD refines description to standardized version NVD experts publish official CVSS scores

CVE ID assigned; NVD lacks description or score CVE ID and initial description exist; no CVSS score Description complete; score may still be missing Both description and scoring are fully finalized

VPre within that boundary, fixing the Pre-T0 operating window and the Phase P / Phase A correspondence on which the rest of the paper relies. Finally, § 3.3 turns that positioning into two concrete design choices: Security-Evidence Screening removes non-security reports and sentences, and dimension-level evidence density D(m) determines a frozen SER/EEC routing table reused at inference time. The notation, threshold symbols, and frozen routing rule defined here are reused directly by the implementation in § 4 and by the ablation analysis in § 5.4. 3.1

The PARSE Lifecycle Model

Most existing automated CVSS prediction studies rely on descriptions of already confirmed vulnerabilities, typically standardized NVD records, thereby modeling each vulnerability at a single, relatively static information state [20], [21], [24], [31], [52], [66]. As established in the Introduction, early CVSS forecasting is not merely late-stage prediction moved earlier, but a distinct task under an evolving information regime: the available evidence develops from tentative, unstructured reports into confirmed and standardized assessments [14], [15], [16], [17]. This distinction makes an explicit model of the vulnerability disclosure lifecycle necessary to define when forecasting occurs and what information is available at that point. Accordingly, to formalise the temporal and informational boundary of our task, we introduce the PARSE vulnerability disclosure lifecycle model with Table 1 and Table 2. Table 1 names the five lifecycle phases and their security events, while Table 2 anchors those phases to observable disclosure milestones and the data available at each milestone. The PARSE model is structured around five phases anchored by four critical time nodes. The five phases—P (Probing), A (Acknowledgment), R (Reservation), S (Standardization), and E (Evaluation)—capture the qualitative stages of vulnerability disclosure, each characterized by distinct textual properties and information availability. The four time nodes—T0 , T1 , T2 , and T3 —mark objective, verifiable milestones. Phase P occurs before T0 and captures initial probing, while Phase A extends through the PreT0 acknowledgment process and ends at T0 . During this combined P/A window, only raw, unstructured reports exist, with no standardized NVD description and no CVSS score. Phase R spans T0 –T1 : a CVE ID is assigned at T0 , and

the vulnerability remains under embargo until T1 . Phase S progresses through T1 –T2 –T3 : vulnerability details emerge at T1 , the NVD description reaches its standardized form at T2 , and the official description and CVSS score are finalized at T3 . Phase E begins after T3 , when the finalized description and score become available for downstream evaluation. Figure 1 summarizes the lifecycle from left to right. The upper colored band names the five PARSE phases; the milestone arrows below it locate bug confirmation, CVE reservation at T0 , initial NVD publication at T1 , description refinement at T2 , and official scoring at T3 . P and A jointly cover the pre-T0 process where VPre operates; R spans T0 –T1 ; S covers the successive T1 –T2 –T3 milestones; and E begins after T3 . In the lower comparison lane, the solid VPre interval begins before T0 , whereas the dashed AutoCVSS/CVEDrill and KBS baseline box is aligned with the late-S/E regime because those methods depend on standardized descriptions and finalized scores. The bottom double-headed arrow denotes the timestamp-derived earlywarning interval between these operating points; paired VPre-Bench samples yield a mean of 38 days and an observed range of 21–60 days. It is a disclosure-time difference, not model execution time. This layered structure—five phases driven by four nodes—reveals the central asymmetry of the paper: existing baselines operate on late-stage, information-rich data, whereas VPre intervenes before a CVE ID exists. The main point of Figure 1 is the temporal mismatch between training data and intended deployment. VPre is designed for the left side of the timeline, whereas NVDtrained baselines are naturally aligned with the right side after standardization and official scoring. 3.2

VPre’s Operating Window within PARSE

Why position matters. The PARSE model in § 3.1 does not by itself determine where CVSS prediction should occur. Any CVSS prediction task, however, must answer two questions that the lifecycle makes explicit: at which disclosure phase does prediction occur, and what information is then available. This subsection fixes VPre’s position along both axes. It also explains why that position is the one that existing methods leave empty. Phase and time-node. VPre targets the Phase P and Phase A window before T0 , where no CVE identifier, no

5

P Phase Probing

A Phase Ack.

R Phase Reservation

S Phase Standardization

Bug Discovered & Confirmed

CVE ID Assigned (Embargo)

Embargo Ends OSINT Emerges

Pre-T0 (Day < 0) Unstructured OSINT Bug reports / issues

T0 (Day 0) CVE ID only No description / score

T1 Initial description No CVSS score

VPre Framework Intervention (Ours)

NVD Refines Description T2 (+21 days) Standardized desc. Score may be missing

E Phase Evaluation Official CVSS Published T3 (+60 days) Final description and CVSS

Baseline AutoCVSS (CVEDrill)2025 KBS 2025

Relies on standardized Phase S/E data Delayed by 21-60 days

Early Warning Gap: Significant Time Gain of 21-60 Days

Fig. 1. PARSE lifecycle and the early intervention point of VPre.

NVD description, and no CVSS score yet exist. Phase R and later phases are out of scope: those are where the Kühn et al., AutoCVSS, and KBS 2025 baselines naturally operate. Information regime. Within this window, the only inputs are raw, unstructured disclosures that may describe security vulnerabilities, functional bugs, or non-security content, with no standardised labels. The prediction target is the full CVSS v3.1 vector and base score. This combination of inputs and target is what we mean by Pre-T0 CVSS forecasting. Why this position. Two reasons motivate VPre’s operating window. First, Phase P/A provides the earliest warning window: a CVE ID is assigned at T0 , vulnerability information is progressively standardized through T1 –T2 –T3 , and official scoring is finalized at T3 . Second, the unique information regime of this window—tentative reports, absent ground-truth labels, and the mixture of security and nonsecurity content—is precisely what existing NVD-trained methods cannot handle. VPre fills that gap; it does not compete with later-phase methods on their own input regime. 3.3 Methodology Foundation: Evidence-Aware Decoupling Directly transferring models trained on curated NVD descriptions to early OSINT reports fails because the two textual regimes differ fundamentally in information structure (§ 3.3.1). The core idea of VPre therefore proceeds in two steps: it first screens security-relevant evidence from noisy early reports, and then decouples the prediction task according to the evidence characteristics and reasoning demands of the eight CVSS base metrics. We term this principle Evidence-Aware Decoupling: prediction is decoupled along the structure of the evidence instead of being handled by one uniform predictor. The principle operates at two levels. Decoupling Level I, Security-Evidence Screening, separates security-relevant evidence from the noisy early OSINT stream at two granularities and contracts the input into a concentrated evidence set R′ (§ 3.3.2). Decoupling Level II, Evidence-Matched Routing, routes the prediction task of each metric to the specialized predictor matched to its evidence characteristics and reasoning demands (§ 3.3.3). 3.3.1 Why direct transfer fails: Semantic Drift The vulnerability disclosure process is not merely a chronological sequence—it is a trajectory of linguistic transformation. Late S/E-stage NVD descriptions and early P/A-stage

OSINT belong to fundamentally different linguistic registers. A late-stage NVD entry is a carefully curated, deterministic security statement: every sentence serves a specific diagnostic purpose, written in standardized terminology by experts who already know the vulnerability’s full scope (e.g., “Improper input validation in the HTTP parser allows remote attackers to execute arbitrary code via a crafted packet”). In contrast, an early-stage raw OSINT report is an evolving, multi-voice conversation: a developer reports unexpected behavior ("the server crashes when I send a malformed request"), another contributor speculates about exploitability ("this might be reachable from the network"), yet another suggests a workaround ("should we add a bounds check here?"), all interspersed with stack traces, version logs, and tangential discussion. This is not a difference of vocabulary—it is a difference in information structure: late-stage text is curated and conclusive, while early-stage text is exploratory, contradictory, and predominantly non-security in content. Existing models trained solely on late-stage NVD descriptions learn a specific mapping from concise, expert-authored security prose to CVSS vector labels [20]. When the existing model is directly applied to early OSINT—without any adaptation to this radically different textual environment—the learned mapping breaks down. This is the phenomenon we term semantic drift. The empirical evidence is unambiguous: the reproduced BERT-Small-NVD checkpoint achieves an MAE of 0.8918 on its native late-stage NVD test set. When the identical checkpoint is evaluated on early-stage VPreBench reports without retraining or architectural modification, its MAE rises to 1.3095, corresponding to a 47% increase in prediction error. Importantly, this degradation is not uniform across CVSS dimensions. Dimensions whose prediction relies on explicit lexical cues present in both registers (e.g., Availability, where "DoS" and "crash" appear in both early and late stages) suffer less. Dimensions requiring inference about attack preconditions, privilege states, or user involvement—information that is explicit in latestage curated prose but scattered or absent in early-stage exploratory discussion—deteriorate far more severely. Figure 2 compares an early-report excerpt with a standardized CVE/NVD description of the same case, CVE2023-27537. The left panel discusses shared HSTS data in libcurl, concurrent access or removal by multiple threads, and possible double-free or use-after-free behavior, together with uncertainty about thread-safety guarantees, exploitability, and untested configurations. The right panel

6

CVE-2023-27537 Phase-1

Raw Vulnerability Report (HackerOne #1897203)

1

It seems that double-free or use-after-free may occur when using HSTS data in a multi-threaded environment.

2

HSTS entries expire after some time and then get removed from the shared list.

3

I suspect that if two threads access or delete the same entry at the same time, there is a missing exclusive control.

4

I think this is a vulnerability.

5

libcurl claims to be thread safe.

6

However it is also stated that libcurl itself does not provide any internal synchronization.

7

I'm not sure if the HSTS data that is shared between easy handles falls under any of the documented exceptions of the thread safety.

8

I could not find an explicit statement about this in the documentation.

9

If two easy handles share the same HSTS data via a share handle, one thread could be reading an entry while another thread removes an expired one.

10

In that case a double-free or use-after-free may occur.

11

This could lead to a crash of the application.

12

Depending on the timing of the threads I'm not sure if this is reliably exploitable.

13

I also don't know yet if it could lead to something more serious than a denial of service.

14

I have not tested all possible configurations.

Phase-5

Official CVE/NVD Description

1

A double free vulnerability exists in libcurl < 8.0.0.

2

The functionality that shares HSTS data between different handles does not account for cross-thread sharing.

3

The documentation does not clearly state this limitation.

4

Due to the lack of a mutex lock or other thread lock, two threads sharing the same HSTS data may trigger a double-free or use-after-free.

Sentence Labels (by sentence)

VT

Vulnerability Trigger (conditions that may lead to the flaw)

CP

Crash Phenomenon (observed or potential security impact)

O

Other Information (background, speculation, uncertainty, etc.)

Fig. 2. Illustrative comparison of early-report and standardized CVE/NVD text for CVE-2023-27537, with sentence-role annotations.

condenses the affected version range, the cross-thread sharing limitation, and the lack of mutual exclusion into a more concise description of the memory-safety problem. The comparison therefore illustrates a change in information organization and evidential certainty across disclosure stages, rather than a difference between two vulnerabilities or merely between document lengths. The colors distinguish vulnerability-trigger evidence (VT), consequence evidence (CP), and other information (O). The figure uses the example-specific wording “Crash Phenomenon” for CP; in the method, CP denotes the broader Consequence Phenomenon category defined in Table 3. These illustrative O labels are not deletion decisions: the STDU rule in Equation 1 removes only high-confidence O predictions and retains low-confidence O sentences. This difference in information organization helps explain why a feature mapping learned from concise NVD prose can become unreliable when applied directly to early reports.

stream—in the PARSE-Triage setting, non-security reports outnumber genuine vulnerabilities by approximately 38:1— and at the sentence level, even accepted reports contain stack traces, version references, and tangential discussion that carry no CVSS-relevant signal; feeding raw reports to any predictor therefore injects noise before prediction begins. Second, even among security-relevant sentences, the eight CVSS metrics differ in how explicitly their evidence is expressed, so a single predictor cannot serve all of them uniformly. These two gaps motivate the two levels of EvidenceAware Decoupling introduced above: Security-Evidence Screening separates security-relevant evidence from this two-granularity noise to recover a concentrated evidence set (§ 3.3.2), and Evidence-Matched Routing partitions the eight metrics by evidence density to match each cluster to an appropriate predictor (§ 3.3.3).

The key visual message of Figure 2 is that early OSINT contains useful security evidence, but it is embedded in a noisier and less conclusive register than NVD text. Semantic drift thus exposes not one but two structural gaps between OSINT and NVD. First, noise exists at two granularities: at the report level, non-security reports (ordinary functional, usability, build, or documentation defects) dominate the raw

Security-Evidence Screening responds to the twogranularity noise identified in § 3.3.1 with two matching decisions. At the report level, non-security reports— ordinary functional, usability, build, or documentation defects that can never yield a CVSS vector—are removed from the stream before any prediction is attempted, so that downstream modules consume only cases that can

3.3.2

Decoupling Level I: Security-Evidence Screening

7

plausibly carry security evidence. At the sentence level, only sentences predicted as O with high confidence are removed from each accepted report; VT/CP predictions and low-confidence O sentences are retained, so that prediction reads a conservatively screened evidence set rather than the raw noisy narrative. We term this two-granularity separation Security-Evidence Screening, the first level of Evidence-Aware Decoupling. The remainder of this subsection specifies the sentence-level decision; the reportlevel decision is methodological in nature and its concrete realization is described with the implementation in § 4.2. Not every sentence in an early OSINT report carries a security signal. We first define three semantic categories at the sentence level. VT (Vulnerability Trigger) describes how a vulnerability is activated—e.g., “crafted request” and “malformed packet”. CP (Consequence Phenomenon) describes the observable security consequence—e.g., “crash”, “out-of-bounds read”, and “RCE”. Everything else—stack traces, version references, configuration notes, and general discussion—falls into O (Other) and carries no CVSSrelevant signal. These three labels form the basis of the sentence-level screening decision. The core idea of the sentence-level decision is straightforward: downstream CVSS prediction models do not need to read the entire raw report—they only need the subset of sentences that directly pertain to security. Contracting the input from a noisy, speculative narrative to a securityfocused evidence set increases the concentration of taskrelevant evidence before prediction. To implement this at scale, we fine-tune a lightweight DistilBERT-based sentence classifier—VulnExtractClassifier—for three-way classification (VT/CP/O) [56]. For each sentence si , the classifier outputs a probability distribution over the three categories. The screening decision deliberately avoids a symmetric “keep only confident VT/CP” rule: deleting a sentence that actually carries attack preconditions or consequences is far more harmful than keeping an additional non-security sentence, because lost evidence cannot be recovered downstream. The filtering action therefore removes a sentence only when the classifier is confidently certain that it is irrelevant, as specified in Equation 1:

R′ = {si ∈ R | ŷi ̸= O ∨ P (O | si ) ≤ τs } , ŷi = arg max P (k | si ).

(1)

k∈{O,V T,CP }

That is, a sentence is deleted only when its predicted label is O and the O-class probability exceeds the threshold τs ; predicted VT/CP sentences and low-confidence O sentences are all retained. The threshold controls how strict the deletion condition is: a higher τs demands stronger evidence of irrelevance before deleting, retaining more sentences and higher evidence recall at the cost of admitting more noise; a lower τs deletes more aggressively, yielding purer but potentially evidence-sparse input. The threshold τs is tuned exclusively on the validation split of the manually annotated sentence data; the same split also governs model selection (the training split fits the classifier, the validation split selects the checkpoint and τs , and the held-out test split is evaluated only once after all choices are frozen), so no threshold decision ever touches the test data. In summary, Security-Evidence Screening operates at two granularities—

discarding non-security reports and removing only confidently irrelevant sentences—and contracts the raw stream into the concentrated evidence set R′ ; it constitutes the first level of Evidence-Aware Decoupling and prepares the input for the second, metric-wise predictor decoupling level. 3.3.3 Decoupling Level II: Evidence-Matched Routing The Security-Evidence Screening in § 3.3.2—discarding nonsecurity reports, classifying each remaining sentence as VT, CP, or O, and deleting only confidently irrelevant ones— produces a filtered sentence set R′ with substantially reduced noise. However, removing irrelevant content is only the first step. Even within R′ , a fundamental asymmetry remains. CVSS v3.1 defines eight base metrics—Attack Vector (AV), Attack Complexity (AC), Privileges Required (PR), User Interaction (UI), Scope (S), Confidentiality (C), Integrity (I), and Availability (A)—and these eight dimensions draw on different types and densities of textual evidence. Impact dimensions such as C, I, and A are often signaled by explicit lexical anchors such as "information disclosure," "tampering," or "denial of service." In contrast, AV, AC, PR, and UI often require linking multiple clauses about the attack precondition, triggering context, privilege state, and user participation. Blindly feeding the same text to the same model for every dimension would therefore be doubly wasteful: it would spend expensive LLM inference on dimensions a lightweight classifier can handle deterministically, while simultaneously denying genuinely complex dimensions the focused reasoning they require. The framework therefore moves from sentence-level evidence selection to metric-level predictor decoupling, and requires a quantitative way to characterize this asymmetry. We use metric-level evidence density to describe how consistently a CVSS metric is expressed through explicit, recurring, and locally identifiable cues in early OSINT, rather than the number or percentage of sentences that mention it. Metrics with high evidence density tend to exhibit stable evidence patterns, whereas low-density metrics rely more on evidence scattered across sentences and on contextual relations. We quantify this dataset-level property using D(m), a report-balanced statistic derived from the normalized angular distances between retained sentences and the fixed CVSS definition anchor of each metric:

2 arccos(cos_sim(hi , hm )) , π 1 X 1 X aX (m) = δ(si , m), |I| j∈I |Xj | s ∈X i j (2)   aX (m) − āM DX (m) = θmin + (θmax − θmin )L , sM 1 L(z) = , X ∈ {R, R′ }. 1 + e−z where I indexes the reports of VPre-Bench-Val, the validation split of VPre-Bench; Xj denotes the sentences of report j that belong to X (R before and R′ after SecurityEvidence Screening); hi = embed(si ) and hm = embed(m); δ(si , m) is the normalized angular distance; and aX (m) is its report-balanced mean. The semantic anchor hm encodes the frozen official CVSS definition for metric m using DistilBERT [56]. The terms āM and sM are the mean and standard δ(si , m) =

8 Route to SER (LLM)

0.8

D(m) - Evidence Density

deviation of the eight metric-level angular-distance statistics on the validation set and are held fixed at test time. The term δ(si , m) converts cosine similarity into normalized angular distance, which removes the effect of embedding norms so that a larger raw dot product cannot be mistaken for stronger semantic evidence. The averaging is deliberately two-level—sentences are averaged within each report, and reports are then averaged again—so that a longer report does not gain a larger weight simply by containing more sentences; every validation report contributes equally to D(m). All eight metrics are then passed through one and the same logistic normalization into the interval [θmin , θmax ], the preset routing-search range: this introduces no metricspecific weights and embeds no group information about AV/AC/PR/UI or S/C/I/A, so the relative order of the metrics is preserved and their D(m) values become directly comparable on one scale. D(m) is a relative dataset-level indicator for cross-metric comparison and routing, rather than raw semantic similarity or a percentage. On VPre-BenchVal, higher-scoring metrics exhibit more stable and locally recognizable evidence patterns, whereas lower-scoring metrics rely more on scattered and context-dependent evidence. The statistic is estimated once on VPre-Bench-Val and is neither a calibrated prediction confidence nor a score recomputed per report. Estimating DR′ (m) across the eight metrics yields a clear empirical pattern rather than a continuum: the values fall into two well-separated clusters (Figure 3). C (D = 0.7513), S (D = 0.6497), I (D = 0.6422), and A (D = 0.6386) form a high-density cluster (mean 0.6705), whereas PR (D = 0.5716), UI (D = 0.5479), AC (D = 0.5013), and AV (D = 0.4790) form a low-density cluster (mean 0.5249). The boundary θD is selected from the discrete candidates {0.4, 0.5, 0.6, 0.7, 0.8} with full-vector MAE as the objective, yielding θD = 0.6, which falls in the gap between the two clusters and separates them cleanly: the maximum of the low-density cluster is 0.5716 and the minimum of the high-density cluster is 0.6386, both at a clear margin from the boundary. In Figure 3, each bar is one CVSS metric labeled with its validation-set D(m), and the dashed line marks θD = 0.6; the red AV/AC/PR/UI bars sit below the boundary and the blue S/C/I/A bars sit at or above it. Bar height therefore represents typical metric-level evidence density, not prediction accuracy, CVSS severity, or a report-specific confidence score. The two-cluster pattern was established empirically on VPre-Bench-Val (the 470 reports with non-empty filtered evidence, covering 5,539 sentences before and 4,555 after sentence-level screening). We do not claim that it is universal across datasets; rather, it is a reproducible regularity of the evidence environment studied here that directly determines VPre’s fixed routing table, and a new dataset can re-estimate D(m) under the same procedure to verify or revise the clustering structure. The low-density cluster corresponds to dimensions requiring cross-sentence inference (AV/AC/PR/UI), whereas the high-density cluster corresponds to dimensions carried by more explicit lexical anchors (S/C/I/A). Marchiori et al. [37] independently reported a partially aligned model-performance pattern— LLMs performed better on AV and AC, whereas embedding+XGBoost performed better on C, I, and A. Their result provides qualitative evidence of metric heterogeneity,

0.7 0.5716

0.6 0.5

0.4790

0.5013

Route to EEC (Supervised) 0.7513

0.6497 θD = 0.6 0.5479

0.6422 0.6386

0.4 0.3 0.2 0.1 0.0

AV

AC

PR

UI

S

C

I

A

Fig. 3. Stable two-cluster evidence-density pattern across the eight CVSS base metrics.

whereas D(m) supplies a quantitative validation-stage criterion for fixing VPre’s routing table. The stable two-cluster structure has a direct methodological implication: the eight metrics should not be served by a single predictor, but decoupled into two paths, each routed to a predictor matched to its evidence pattern. We call these two paths the reasoning route, which serves the lowdensity cluster through cross-sentence inference, and the lexical route, which serves the high-density cluster through supervised classification over explicit lexical evidence. We formalize this decoupling as a validation-stage routing rule: ( EEC, D(m) ≥ θD , m→ (3) SER, D(m) < θD . Under this rule, the high-density cluster (S/C/I/A) is routed to the Explicit-Evidence Classifier (EEC, § 4.5), the predictor instantiating the lexical route, and the low-density cluster (AV/AC/PR/UI) to the Scattered-Evidence Reasoner (SER, § 4.4), the predictor instantiating the reasoning route; their concrete designs are described in the respective subsections. The resulting routing table is fixed once at the validation stage and reused for all VPre-Bench inference; at test time the only per-report operation is STDU screening. Thus θD serves to explain and reproduce the offline metric split rather than to dispatch individual cases. Section conclusion. Evidence-Aware Decoupling is VPre’s methodological foundation. It operates at two levels: Security-Evidence Screening separates evidence preparation from prediction, and validation-derived Evidence-Matched Routing separates a uniform eight-metric predictor into specialized SER and EEC paths. Semantic drift (§ 3.3.1) explains why direct SOTA transfer fails. Security-Evidence Screening (§ 3.3.2) explains why screening must precede prediction. Evidence-matched routing (§ 3.3.3) defines the fixed model assignment, which is necessary because the eight metrics do not present one uniform prediction problem. Together, these principles justify the STDU-to-SER/EEC architecture.

4

VP RE F RAMEWORK I MPLEMENTATION

The implementation follows the methodology established in § 3.3. Specifically, STDU implements Security-Evidence Screening (Decoupling Level I), and the fixed routing table together with the SER and EEC predictors implements Evidence-Matched Routing (Decoupling Level II).

9

STDU-SER-EEC & 8-Vector Extraction

Input Source Layer

Data ingestion and preprocessing of unstructured vulnerability text

STDU (Semantic Triage and Denoising Unit)

Early filtering to improve efficiency and scoring precision

AC - Attack Complexity

SER (LLM)

PR - Privileges Required

Security Sentence Triage Screening

Data ingestion and preprocessing of unstructured vulnerability text

Input Source Layer

Invalid / Discard

Quantitative vulnerability severity prioritization and risk management

AV - Attack Vector

D(m) < θ_D

Unstructured Early-OSINT Text Reports

Output Layer

UI - User Interaction

Standard CVSS v3.1 Calculation Engine

Final CVSS Score (0.0 - 10.0)

S - Scope D(m) ≥ θ_D

Discarded Non-Security Bugs

EEC (Supervised)

C - Confidentiality

I - Integrity A - Availability

Early filtering to improve efficiency and scoring

Hybrid Intelligent Processing & 8-Vector Extraction

Output Layer

Fig. 4. Overall VPre architecture under two-level Evidence-Aware Decoupling.

An early report is first screened and reduced to securityrelevant sentences; the resulting evidence is then passed to a routing table fixed on the validation set, which assigns AV/AC/PR/UI to SER and S/C/I/A to EEC. The following subsections describe this data path and the concrete realization of each module. The LLM and backbone comparisons used in the final configuration are retained with the SER and EEC descriptions. 4.1

Framework Architecture Overview

Figure 4 shows the complete path from a raw OSINT report to a CVSS v3.1 vector. The report first enters STDU, where a report-level decision removes non-security bugs and sentence-level screening retains VT/CP predictions and low-confidence O sentences from accepted reports, removing only high-confidence O predictions. The surviving sentences form R′ , which is shared by the two prediction branches rather than being processed as two separate inputs. The branch assignment is obtained before test inference from the validation-set statistic D(m). It is therefore a lookup operation at deployment time, not a new evidencedensity estimate for every incoming report. AV, AC, PR, and UI are sent to SER because their evidence is commonly distributed across sentences, whereas S, C, I, and A are sent to EEC because their effects are more often expressed by stable lexical cues. The eight categorical outputs are finally assembled in the standard metric order and converted into the CVSS v3.1 base score. This separation also provides the module boundaries used in the ablation study of § 5.4: evidence screening can be removed independently of the SER/EEC assignment, and either prediction branch can be evaluated under the same filtered input. 4.2

Decoupling Level I: Security-Evidence Screening

STDU implements Decoupling Level I, Security-Evidence Screening, operating at both granularities defined in § 3.3.2. The raw report stream contains both ordinary software defects and security-relevant cases, and even accepted reports

contain large amounts of text that does not contribute to CVSS prediction. STDU screens these two sources of noise at their respective granularities. Report-level security triage.: At the report level, STDU employs GPT-4o-mini to determine whether a sanitized report describes a security-relevant weakness. This decision is deliberately entrusted to an LLM rather than keyword or rule-based matching, because security words alone are unreliable evidence: reports of ordinary functional defects also mention “security” or “crash”, so the triage must judge the technical condition described in the report— whether attacker-controlled or untrusted input can plausibly reach a weakness and violate a security boundary— rather than the mere presence of security vocabulary. The prompt correspondingly favors recall under incomplete evidence: an early report may be tentative and incomplete yet still security-relevant, and discarding a genuine vulnerability at the gate is more costly than admitting an occasional non-security report, which the sentence-level stage can still attenuate. The output is constrained to a closed label, a confidence in [0, 1], and short supporting evidence spans; the parser rejects unknown labels or out-of-range confidence values, and the evidence spans are retained for audit only—they never replace the original sentences in the next stage. The model is queried with temperature 0 and a maximum output length of 160 tokens; the report is enclosed in a <REPORT> block to separate source text from the instruction. A schema violation triggers a single format-only repair request, and a response that remains invalid is recorded as an explicit failure state rather than passed downstream. Reports labeled as ordinary functional, usability, build, or documentation defects are discarded, and API failures are likewise recorded explicitly rather than passed to the scoring modules. The complete instruction and output schema are provided in the supplementary material. Sentence-level VT/CP/O screening.: Reports retained by the report-level decision are segmented into sentences and passed to V ULN E XTRACT C LASSIFIER, the sentence classifier that realizes the screening rule of Equation 1.

10

We fine-tune this classifier ourselves rather than using a zero-shot model, for two reasons. First, the VT/CP/O boundary is semantic rather than lexical: the same word “request” marks a vulnerability trigger in “crafted request” but is neutral in “request body”, and O-class text such as scheduling or repair-only discussion frequently co-occurs with security vocabulary, so rules or keyword matching cannot draw the boundary. Second, delegating the persentence decision to a general-purpose LLM would multiply pipeline cost—a report contains dozens of sentences and the report-level gate already consumes an LLM call—so the sentence level uses a lightweight fine-tuned encoder (66Mparameter DistilBERT) instead. The training data come from the 5,581-report cleaned VPre-Bench corpus: five graduate annotators labeled the sentences of the 4,257 training and 473 validation reports sentence by sentence (49,686 training and 5,101 validation sentences), with disagreements adjudicated by a third annotator, under the label operationalizations in Table 3. The class distribution is imbalanced (O 39.0%, VT 13.5%, CP 47.5% in training), which reflects the composition of real early reports rather than a sampling choice. Training proceeds in two stages: the encoder is first adapted to the early-report domain with one epoch of maskedlanguage modeling over 12,000 unlabeled training-partition sentences, and is then frozen while a three-way classification head is trained on the 49,686 labeled sentences (best epoch 9, learning rate 10−3 , maximum length 128, seed 42; full configuration in the supplementary material). On the 10,108-sentence test split, the classifier reaches 84.02% accuracy (macro-F1 80.31%), with per-class F1 of 83.72% (O), 69.29% (VT), and 87.93% (CP). Under the conservative deletion rule of Equation 1 with τs = 0.90, this translates into an evidence recall of 99.32%—only 0.68% of true VT/CP sentences are lost—at a retained-set precision of 70.48%; the retained non-evidence sentences are left for SER and EEC to process rather than being deleted on uncertain grounds. The threshold is selected only on the 5,101-sentence validation fold: among candidates {0.50, 0.60, 0.70, 0.80, 0.90}, the rule keeps the recall within

TABLE 3 Operational definitions of the STDU sentence labels.

Label Meaning VT

CP

O

0.01 of the maximum and then maximizes retained-set precision, breaking ties toward the lower threshold; the test set is never consulted. If every sentence of a report is removed as a high-confidence O, STDU returns EMPTY_EVIDENCE instead of restoring the original report: restoring the full text would silently cancel screening and re-inject all noise, whereas the explicit EMPTY_EVIDENCE state marks the case as lacking evidence, remains auditable, and produces no fabricated CVSS vector. This state is rare—6 of 851 test reports (0.71%)—indicating that the conservative rule seldom rejects a report outright. Figure 5 traces the two decisions along the data path. A raw report first reaches the security-triage gate: a negative decision follows the discard exit and the case never enters scoring, while an accepted report proceeds to sentence splitting. VulnExtractClassifier then labels every sentence, and the deletion rule removes only the high-confidence O sentences; VT/CP predictions and low-confidence O sentences survive into R′ . The figure thus encodes exactly two filters at two granularities: report-level triage decides whether a case enters VPre, and sentence-level screening decides which sentences of an accepted case are visible to SER and EEC.

Delete O if P(O|s)>0.90

Fig. 5. Decoupling Level I: STDU-based Security-Evidence Screening.

Include / exclude criterion

Vulnerability Trig- Attacker capability, required ger state, exposed interface, crafted input, or the action that activates the weakness. Consequence Phe- Security-relevant disclosure, nomenon privilege gain, corruption, bypass, exhaustion, or reachable crash. Other Metadata, scheduling, acknowledgments, versiononly text, repair-only discussion, or unrelated diagnostics.

11

1

Sentence-Level Evidence Screening

2

Discard iff predicted O and P(O | s) > 0.90

D(m): validation-set evidence density Estimated once; frozen routing

D(m) >= 0.6

Raw OSINT report Filtered evidence R'

VT retained

Dimension-Level Evidence Routing

S / C / I / A -> EEC

Routing threshold: 0.6

CP retained

D(m) < 0.6

O: discard only if P(O)>0.90

AV / AC / PR / UI -> SER

Filtered evidence: R' = VT + CP + low-conf O

Fig. 6. Two levels of Evidence-Aware Decoupling: Level I, Security-Evidence Screening; Level II, Evidence-Matched Routing.

4.3

Decoupling Level II: Evidence-Matched Routing ′

After STDU produces R , the unit of decision changes from sentences to CVSS metrics. The sentence-level probabilities P (k | si ) have already served their purpose by deciding which evidence is retained; they are not interpreted as uncertainty in the final CVSS prediction. The subsequent split instead uses the validation-set statistic D(m), which describes how explicitly each metric is expressed across the filtered reports. This subsection realizes Evidence-Matched Routing (Decoupling Level II) as an offline lookup whose result is frozen before deployment. This change of granularity is summarized in Figure 6. The left side removes only high-confidence O sentences to form R′ , while the right side compares the metric-level D(m) values with θD = 0.6. Under the routing rule in Equation 3, AV/AC/PR/UI are assigned to SER and S/C/I/A to EEC; equality is assigned to EEC. The same R′ is supplied to both routes, so the split changes the predictor used for a metric rather than the evidence available for an individual report. 4.4

SER: Scattered-Evidence Reasoner

AV, AC, PR, and UI are not always stated in a single sentence. Their prediction may depend on linking reachability, conditions outside the attacker’s control, privileges held before exploitation, and actions expected from another user. SER therefore reads the complete filtered set R′ and predicts these four metrics jointly with GPT-4o-mini. The retained sentences are numbered s1 , . . . , sn and placed in a single <EVIDENCE> block, which the prompt treats as the only admissible source of vulnerability evidence. The Chain-of-Thought instruction then considers each metric according to its CVSS definition: reachability and attacker position for AV, uncontrollable preconditions for AC, privileges held before exploitation for PR, and a separate user’s action for UI [47], [48]. Before committing to a class, the model is asked to cite the supporting sentence identifiers and check common confusions, such as treating every “remote” report as AV:N or conflating AC with PR.

When the evidence is incomplete, the prompt requires a lower confidence instead of an invented attack scenario. Each prediction contains a legal value, a confidence in [0, 1], the cited sentence identifiers, and a short rationale. Inference uses temperature 0 and a maximum output length of 600 tokens. The parser accepts exactly the keys AV, AC, PR, and UI and checks their CVSS v3.1 domains: AV ∈ {N, A, L, P}, AC ∈ {L, H}, PR ∈ {N, L, H}, and UI ∈ {N, R}. Confidence ranges, evidence identifiers, and rationales are checked at the same time. A schema violation triggers one format-only repair request; if the repaired response is still invalid, the case is recorded as SER_PARSE_FAIL. The complete prompt and output schema are provided in the supplementary material. To select the LLM for SER, five general-purpose LLMs (GPT-4o-mini, DeepSeek-V3, Qwen3.5, Llama-4-scout, and Grok-4-fast) are compared without task-specific fine-tuning; with CoT fixed, all are evaluated under the same input and decoding configuration in Table 4. Table 4 favors GPT-4o-mini on every routed metric; its AV/AC/PR/UI mean is 83.18%, while DeepSeek-V3 ranks second at 75.91%. The S/C/I/A columns are included as a diagnostic control, not as SER outputs. GPT-4o-mini retains 83.31% accuracy on S but falls to 68.04%, 63.81%, and 67.80% on C, I, and A, and the best-performing LLM is not the same across these columns. By contrast, BERT-Small-VPre obtains 90.60%, 83.67%, 82.37%, and 85.90% on S/C/I/A, which supports retaining these metrics on the EEC route. 4.5

EEC: Explicit-Evidence Classifier

Compared with AV, AC, PR, and UI, the S, C, I, and A metrics are more often supported by direct lexical cues in early reports; EEC therefore treats their prediction as supervised text classification over R′ . Three suffixes distinguish checkpoints that share the BERT-Small architecture but have different training histories. BERT-Small-PT, where PT means pretrained, is the public prajjwal1/bert-small checkpoint used for parameter initialization before task-specific fine-tuning. BERT-

12

TABLE 4 Validation-set per-metric SER accuracy under CoT prompting and mean accuracy on the routed AV/AC/PR/UI metrics (%).

Model

AV

AC

PR

UI

S

C

I

A

Routed Mean

GPT-4o-mini (Selected) DeepSeek-V3 Qwen3.5 Llama-4-scout Grok-4-fast

80.61 78.50 76.94 71.77 72.00

87.19 83.55 64.19 52.00 70.00

79.38 70.39 60.77 57.14 62.00

85.55 71.18 59.72 62.24 68.00

83.31 73.65 80.32 75.51 80.00

68.04 67.57 45.31 84.54 56.00

63.81 52.76 75.48 72.83 84.00

67.80 65.33 67.33 60.00 80.00

83.18 75.91 65.41 60.79 68.00

Bold indicates the best result in each column, and underlining indicates the second-best result. “Selected” identifies the model used by SER.

Small-NVD is the reproduced model fine-tuned on standardized late-stage NVD descriptions and evaluated both on NVD input and by direct transfer to early OSINT. BERTSmall-VPre denotes four metric-specific EEC checkpoints. Each checkpoint is initialized from BERT-Small-PT and finetuned separately for S, C, I, or A on the STDU-filtered VPreBench training split. For Table 5, every candidate backbone follows the same four-classifier, 16-epoch protocol and is evaluated on the validation split; the table therefore reports post-fine-tuning model-selection results. The models exhibit different metric preferences: DistilBERT is strongest on S, BERT-Medium on I, and BERTSmall-VPre on C and A. Across S/C/I/A, BERT-Small-VPre reaches the highest mean accuracy of 85.64%, only 0.03 percentage points above BERT-Medium at 85.61%. We select BERT-Small-VPre for its overall balance rather than for a uniform advantage on every metric. Figure 7 depicts the selected EEC configuration from Table 5: four independent BERT-Small-VPre classifiers with separate encoders and classification heads for S, C, I, and A. It shows the final post-selection architecture rather than an additional fine-tuning stage. The S classifier predicts {U, C}, while the other three classifiers predict {N, L, H}. Each classifier is trained for 16 epochs using AdamW with a learning rate of 2 × 10−5 , batch size 32, and random seed 42. AV, AC, PR, and UI remain on the SER route and therefore do not enter this pipeline.

5

E VALUATION

5.1

Evaluation Setup

RQ3: Does the complete Evidence-Aware Decoupling framework (STDU+SER+EEC) outperform the tested nondecoupled and partially decoupled alternatives? Dataset Construction and Temporal-Fidelity Controls. To answer these research questions rigorously, we construct and publicly release two complementary datasets. VPre-Bench is the core benchmark: it supports the accuracy comparison in RQ1, the lead-time measurement, and the module ablations in RQ3, and contains 5,581 CVE entries spanning 2002–2025 with early-stage raw intelligence reconstructed through top-down NVD backtracing. PARSETriage is dedicated to RQ2: it contains 46,940 raw issue descriptions (45,759 non-vulnerability and 1,181 vulnerability reports; noise-to-signal ratio ≈38:1) from five opensource ecosystems—Ambari, Camel, Chromium, Derby, and Wicket—for evaluating screening reliability under high noise. As shown in Figure 8, VPre-Bench draws from two complementary source categories. Curated bug bounty reports, predominantly from HackerOne, serve as high-fidelity anchors: they have passed platform triage, preserve the submitter’s original text, and are naturally free of post-hoc CVSS or remediation commentary, but their scale is limited because many reports are private or restricted. Public OSINT sources—oss-security, Bugzilla, and GitHub Issues— offer broader coverage yet inherently contain information added after the initial disclosure: CVE identifiers appearing later in the same issue thread, CVSS scores cited by community members, and patch links posted after vendor confirmation [7], [15], [16]. Training or evaluating on such unfiltered text would let models learn information unavailable at the prediction moment and artificially inflate earlyforecast performance [3], [7], [49]. As shown in Figure 8, all public-source texts therefore undergo automated sanitization with a domain-specific exclusion dictionary that strips CVE identifiers (e.g., CVE-202X-XXXX), CVSS scoring keywords (e.g., Base Score 9.8), and authoritative references to post-hoc fixes (e.g., official patch released), followed by timestamp verification that retains only pre-NVD segments;

To systematically evaluate VPre, our experiments are driven by three Research Questions. RQ1: Can the VPre framework overcome existing baselines’ dependency on NVD standardized descriptions, achieving comparable or superior prediction accuracy on early OSINT? RQ2: Can STDU reliably identify genuine vulnerabilities within high-noise early-stage intelligence?

TABLE 5 Validation-set EEC backbone accuracy and mean accuracy on the routed S/C/I/A metrics after 16 epochs (%).

Model DistilBERT BERT-Small-VPre (Selected) BERT-Medium DeBERTa-v3-Small

S

C

I

A

Mean

92.01 90.60 91.54 91.19

79.55 83.67 82.26 82.96

82.02 82.37 84.14 80.14

85.43 85.90 84.49 82.96

84.75 85.64 85.61 84.31

Bold indicates the best result in each column, and underlining indicates the second-best result. “Selected” identifies the backbone used by the final EEC.

13

BERT-Small-VPre for S

BERT-Small-VPre for C

BERT-Small-VPre for I

STDU-filtered R'

BERT-Small-VPre for A

Fig. 7. Metric-specific EEC prediction pipeline with four independent BERT-Small-VPre classifiers for S, C, I, and A. NVD CVE Pool

Top-down Backtracing

5,581 CVEs (20022025)

Early Report Leads

VPre-Bench | n = 5,581 | Lead time = T(CVSS) - T(report)

a. Per-record lead time (sorted)

Public OSINT

Bug Bounty Reports HackerOne

oss-security / Bugzilla / GitHub Issues

Light Cleaning

Differential Preprocessing Remove CVE IDs

Remove CVSS terms

Remove posthoc info

Timestamp check

Lead time (days)

60

Mean = 38.0 d 50 40 30 20 1

Time-faithful Early Intelligence

1,400

2,800

4,200

5,581

Vulnerability records, sorted by lead time

Original text Ground-truth CVE/CVSS Temporal fidelity

Fig. 8. VPre-Bench data collection and temporal sanitization pipeline.

NVD descriptions are never used as early-text inputs; each sample further records four timestamps (early intelligence, CVE assignment, NVD description, NVD CVSS) to enforce temporal consistency, and the two paths merge into the leakage-controlled corpus in which titles and sanitized reports serve as model-facing inputs while CVSS vectors and base scores remain separate ground truth. Manual inspection of 200 randomly sampled entries after processing confirmed residual hindsight content below 2%. As shown in Figure 9, the lead time of each record measures how many days its early intelligence precedes official early NVD CVSS scoring: computing ∆ti = TiNVD-CVSS − ti from paired timestamps over the 5,581 matched records yields a mean of 38.0 days, a median of 38 days, an interquartile range of 33–43 days, and an observed range of 21–60 days. This distribution quantifies the early-warning window within which VPre operates, rather than any manually assigned lead. To quantify the impact of semantic drift, we reproduce the NVD-trained checkpoint and denote it BERTSmall-NVD. The same checkpoint is first evaluated on standardized late-stage NVD descriptions and then directly

600

Number of records

VPre-Bench

b. Lead-time distribution Mean = median = 38 d

400

200

0 21

30

40

50

60

Lead time (days)

Fig. 9. Timestamp-derived lead-time distribution in VPre-Bench.

transferred, without retraining, to sanitized early P/A-stage VPre-Bench reports. This cross-phase setup specifically tests whether conventional SOTA supervised models can maintain efficacy in high-noise early-warning scenarios, or fundamentally require VPre’s structural enhancements. Unified notation used throughout § 5.2–§ 5.4: SOTAearly (SOTA directly transferred to early OSINT), VPreearly (VPre on early OSINT—our core result), SOTANVD (SOTA on NVD standard descriptions—late-stage strong baseline), VPreNVD (VPre on NVD standard descriptions—compatibility check). Unless otherwise noted, SOTANVD denotes the directly comparable CVEDrill/AutoCVSS-style NVD reference rather than the non-comparable KBS standardization pipeline.

14

TABLE 6 MAE/MSE comparison with transferred and hybrid baselines.

Architecture

Data Scenario

Reference: Standardized NVD (PARSE S/E) BERT-Small-NVD (Kühn reproduction) Standardized NVD (PARSE S/E) SOTA (CVEDrill, NVD Reference) Standardized NVD (PARSE S/E) SOTA (KBS 2025, NVD Reference) Standardized NVD (PARSE S/E) Early OSINT Baselines: Pre-T0 Reports (PARSE P/A) BERT-Small-NVD (Kühn reproduction) VPre-Bench (PARSE P/A; direct transfer) SOTA (CVEDrill, Early Transfer) VPre-Bench (PARSE P/A) SOTA (KBS 2025, Early Transfer) VPre-Bench (PARSE P/A) Compatibility / Cross-Regime Check VPreNVD (compatibility check) Standardized NVD (PARSE S/E) Full System on Early OSINT: Pre-T0 (PARSE P/A) VPre (STDU–SER–EEC) VPre-Bench (PARSE P/A) TABLE 7 End-to-end MAE/MSE comparison with pure-LLM baselines on the VPre-Bench held-out test set.

MSE

MAE

2.4939 1.2310 0.2990

0.8918 0.5490 0.1660

3.9821 3.1792 2.8192

1.3095 1.2255 1.1680

2.2148

0.8629

1.6859

0.7239

TABLE 8 End-to-end comparison of lightweight single-model baselines with Full VPre on the VPre-Bench held-out test set.

Model

MSE

MAE

Backbone

MSE

MAE

GPT-4o-mini DeepSeek-V3 Qwen3.5 Llama-4-scout Grok-4-fast

3.5220 4.0000 6.2325 4.5141 3.4181

1.3051 1.4491 1.7250 1.6235 1.3771

DistilBERT BERT-Small-VPre DeBERTa-v3-Small BERT-Medium

2.5835 2.5377 2.1581 2.1382

0.8786 0.8772 0.9337 0.8145

Full VPre (STDU–SER–EEC) 1.6859 0.7239

VPre (STDU–SER–EEC) 1.6859 0.7239

5.2

RQ1: VPre vs. SOTA on Early OSINT

Evaluation Focus.: We first establish whether VPre outperforms transferred baselines when both are evaluated on early OSINT and quantify its timestamp-derived forecasting lead. SOTA Reference Results on Late-Stage NVD Data.: On native PARSE S/E-phase standardized data, CVEDrill reports MAE 0.5490 [66] and the KBS 2025 pipeline (GPT3.5-Turbo + BERT-Small) reports MAE 0.166 [31]. Because both results use late-stage standardized inputs, they do not establish performance when only early unstructured OSINT is available. RQ1 compares three baseline families with Full VPre under the early-OSINT setting: transferred and hybrid baselines in Table 6, pure end-to-end LLM baselines in Table 7, and lightweight single-model baselines in Table 8. All VPre-Bench prediction results in this subsection are measured on the same 851-report held-out test set. MAE measures average absolute score error, whereas MSE penalizes larger deviations more strongly; lower values indicate better prediction accuracy. Under the matched VPre-Bench early-OSINT setting, Table 6 shows that Full VPre reduces MAE by 44.7% relative to the reproduced BERT-Small-NVD early-transfer baseline (1.3095 to 0.7239), by 40.9% relative to the CVEDrill earlytransfer baseline (1.2255 to 0.7239), and by 38.0% relative to the measured KBS 2025 early-transfer baseline (1.1680 to 0.7239). The NVD-reference rows remain contextual because they use standardized late-stage inputs. Table 7 shows that Full VPre outperforms all tested pure-LLM baselines in both MAE and MSE under the same VPre-Bench input. Table 8 shows that Full VPre also outperforms the strongest

tested lightweight single-model baseline, indicating that a pure lightweight-model framework—one supervised model covering all eight metrics, however strong its backbone— does not reproduce the complete decoupled framework. Across these matched early-input comparisons, Full VPre remains the strongest tested system; the NVDreference rows provide late-stage context, while module attribution is examined separately in RQ3. Fair Comparison on Early OSINT.: Across the transferred supervised, pure-LLM, and lightweight single-model baselines evaluated on VPre-Bench, VPre yields the lowest error. The consistent pattern indicates that early OSINT benefits from architecture-level adaptation combining STDU filtering, evidence-aware metric assignment, and SER/EEC specialization. Figure 10 is the direct early-OSINT MAE comparison. The horizontal groups and colors distinguish transferred supervised baselines, pure LLM predictors, lightweight singlemodel baselines, and the full VPre system. The three blue transfer bars represent BERT-SmallNVD, CVEDrill, and KBS 2025 evaluated on VPre-Bench, with MAE values of 1.3095, 1.2255, and 1.1680, respectively. The orange bars represent five pure LLM predictors: GPT-4o-mini, DeepSeek-V3, Qwen3.5, Llama-4-scout, and Grok-4-fast, each of which directly predicts the eight CVSS metrics from the early text. The green bars represent four lightweight single-model baselines: DistilBERT, BERT-Small-VPre, DeBERTa-v3-Small, and BERT-Medium, each of which is used alone to predict all eight CVSS metrics. The red bar represents the full VPre system using STDU–SER–EEC. Every solid bar is measured on the same VPre-Bench early text, and the number within each

15

a. Transferred and pure-LLM baselines

(a) Lead time versus MAE

BERT-Small transfer

1.2

1.2255

CVEDrill early

CVEDrill early 38 d | 1.2255

1.4

1.3095

KBS early 38 d | 1.1680

1.1680

KBS early

Observed lead: 21-60 days

MAE

1.3051

GPT-4o-mini

1.4491

DeepSeek-V3

0.8

CVEDrill NVD 0 d | 0.5490

VPre early 38 d | 0.7239

1.7250

Qwen3.5

0.4

1.6235

Llama-4-scout

KBS NVD 0 d | 0.1660

1.3771

Grok-4-fast

0.0

b. Single-model baselines and full VPre DistilBERT

0.8786

BERT-Small-VPre

0.8772

Full VPre 0.6

60

(b) MAE by evaluation regime

0.8145

1.1680

0.7239

0.9

38

1.2

1.2255

0.8629

1.2

1.5

1.8

Mean absolute error (lower is better)

MAE

BERT-Medium

21

Days before official NVD CVSS scoring

0.9337

DeBERTa-v3-Small

0

0.8

0.7239 0.5490

0.4

Fig. 10. MAE comparison on the VPre-Bench held-out test set under the early-OSINT setting.

0.1660

0.0

bar is its MAE. Lower bars indicate lower CVSS prediction error. The horizontal dashed line at MAE 0.8918 represents BERT-Small-NVD evaluated on standardized latestage NVD input. Because this result uses different and later-stage input, it is included only as a reference and is not ranked with the solid bars. Under the same early-OSINT setting, VPre achieves the lowest MAE of 0.7239, while the best-performing lightweight single-model baseline, BERTMedium, obtains an MAE of 0.8145. This comparison shows that using one supervised model to predict all eight CVSS metrics is less effective than using the full STDU–SER–EEC method. Early-Warning Benefit: Prediction 38 Days Before NVD Scoring.: Figure 11 quantifies VPre’s practical earlywarning benefit by jointly showing forecast lead time and prediction error. VPre achieves an MAE of 0.7239 on the 851report held-out test set, while paired timestamps across the full benchmark show an average lead of 38 days (observed range: 21–60 days). NVD-based results are shown only as zero-lead reference points and are not treated as same-input competitors. Figure 11 has two panels that answer different questions. In the left panel, the horizontal axis is days before official NVD CVSS scoring and the vertical axis is MAE: NVD-only reference points sit at 0 days, while VPre and the two earlytransfer baselines are plotted at the observed average lead of 38 days. The shaded 21–60 day region denotes the observed disclosure window rather than a confidence interval, and horizontal position is forecast lead time rather than model runtime. In the right panel, bars restate the exact MAE values and add the VPreNVD compatibility result. Colors and labels distinguish late-stage NVD references, early-transfer measurements, VPre’s early operating point, and the compatibility check. Together, the two panels express a time– error trade-off rather than a single same-data leaderboard: only the early-transfer and VPreearly points share the pre-T0 input regime.

KBS NVD

CVEDrill NVD

VPre early

VPre NVD compat.

KBS early

CVEDrill early

Fig. 11. Lead-time–error trade-off for early CVSS forecasting; NVD-only results are shown as zero-lead references.

5.3

RQ2: STDU Screening Reliability

Evaluation Focus.: STDU screening operates at two granularities; this subsection evaluates the report-level gate under high noise, while the reliability of sentence-level screening has been reported in § 4.2 (84.02% accuracy with 99.32% evidence recall on the test split). Building on RQ1’s assessment of overall early-OSINT performance, we next examine whether STDU can identify genuine vulnerabilities under the extreme ∼38:1 noise setting. Using the PARSE-Triage dataset, STDU was evaluated in zero-shot inference across multiple LLMs (GPT-4o-mini, DeepSeekV3, Qwen3.5, etc.) [48]. Evaluation metrics are Precision, Recall, and F1—not Accuracy, because in a 38:1 imbalanced distribution, an all-benign dummy classifier would achieve ∼97.5% Accuracy with Recall = 0%, rendering Accuracy meaningless. At the report level, GPT-4o-mini achieves Precision 0.98, Recall 1.00, and F1 0.99. Across all evaluated LLMs, F1 remains above 0.95, indicating consistent screening performance within the tested model set. This crossmodel consistency supports the use of LLMs at the STDU gateway for reducing the needle-in-a-haystack problem and filtering semantic noise at data intake. A traditional TF-IDF + XGBoost baseline is included for comparison; its lower Recall suggests that lexical features alone are insufficient to capture implicit security semantics in early reports. Together, these results support STDU as a substantive screening component rather than a cosmetic preprocessing step. 5.4 RQ3: Effectiveness of Two-Level Evidence-Aware Decoupling Evaluation Focus.: Having evaluated overall performance in RQ1 and screening reliability in RQ2, we finally test whether the complete decoupled framework (STDU+SER+EEC) outperforms the tested non-decoupled

16

TABLE 9 Held-out-test ablations of the two Evidence-Aware Decoupling levels.

MSE

MAE

w/o sentence screening SER-only EEC-only (BERT-Medium) Full VPre (STDU–SER–EEC)

2.3847 2.7619 2.1382 1.6859

0.9642 1.0427 0.8145 0.7239

MAE (lower is better)

Variant

Full VPre reference: 0.7239 1.1

0.9642 0.9

0.8

0.7

and partially decoupled alternatives, isolating the contribution of each decoupling level through controlled ablations under the same setting. Four variants are compared. w/o sentence screening (raw text directly to SER/EEC) increases MAE to 0.9642 because irrelevant sentences and non-security noise mislead downstream prediction, particularly on C/I/A dimensions. SER-only (the same STDU-filtered input, with all 8 dimensions routed to the LLM with CoT) increases MAE to 1.0427 because LLMs are less stable than supervised models on dimensions with explicit keyword patterns. EEC-only (the same STDU-filtered input, with all 8 dimensions routed to the BERT-Medium all-metric configuration also reported in Table 8) reaches MAE 0.8145, showing that supervised models remain strong but lack the cross-sentence reasoning needed for AV/AC/PR/UI. Full VPre (STDU plus the fixed SER/EEC split) achieves the lowest held-out test error among the tested variants (MSE 1.6859, MAE 0.7239). These controlled ablations are conducted on the same 851report VPre-Bench held-out test set to isolate the effects of screening and predictor routing, thereby providing designattribution evidence for the complete framework. Within this held-out test comparison, Full VPre reduces MAE by 11.1% relative to EEC-only, 24.9% relative to w/o sentence screening, and 30.6% relative to SER-only. The controls evaluate the two levels separately: w/o sentence screening tests the evidence-preparation decoupling, whereas SER-only and EEC-only test metric-wise SER/EEC specialization under identical filtered input. Figure 12 compares four variants measured on the same VPre-Bench held-out test set. The red dashed line and first bar mark the full-model MAE of 0.7239. Moving right, EEC-only sends all metrics to BERT-Medium, w/o sentence screening keeps the SER/EEC split but removes sentence filtering, and SER-only sends all metrics to CoT prompting; the value printed within each bar is the measured MAE. Because the vertical axis begins above zero, apparent height differences are visually magnified; the numeric labels provide the exact differences. Every tested alternative has higher held-out test MAE than the full system. The pattern supports complementary roles for contextual reasoning, deterministic classification, and denoising; the plot reports performance differences, not statistical significance or universal routing optimality by itself. Each ablation causes a targeted degradation that aligns with VPre’s evidence-aware design rationale. STDU’s sentence-level screening prevents irrelevant text from entering prediction; without it, models learn spurious associations from stack traces, version notes, and repair discussions. SER and EEC address different evidence characteristics and reasoning requirements across metrics: AV/AC/PR/UI require cross-sentence reasoning, whereas

1.0427

1.0

0.8145

0.7239 Full VPre

EEC-only BERT-Med.

w/o sentence screening

SER-only CoT

Fig. 12. Held-out-test ablations of Evidence-Aware Decoupling in VPre.

S/C/I/A benefit from deterministic lexical signals. Thus, VPre’s gain is not attributable to a single stronger model, but to the coordinated effect of sentence-level denoising and SER/EEC specialization. A note on EEC-only with BERT-Medium (MAE 0.8145 vs. VPre’s 0.7239): this variant is a strong supervised baseline, but it treats all eight metrics as if they shared the same evidence structure. VPre instead routes AV/AC/PR/UI to SER for contextual reasoning and S/C/I/A to EEC for deterministic classification. The result is a better balance between reasoning capability, numerical stability, and scalable inference. 5.5

Per-Dimension Error Analysis

Per-Dimension Analysis: The component-selection results reported in § 4.4 and § 4.5 do not show a uniform permetric accuracy advantage for SER on AV/AC/PR/UI; EEC obtains higher classification accuracy on these four metrics in the separately reported component comparison. The routing decision is therefore justified by validationderived evidence characteristics and end-to-end Base-Score error, rather than by a claim that SER wins every routed metric. Per-metric classification accuracy and Base-Score MAE optimize different objectives. EEC shows more stable or comparable performance on S/C/I/A in the reported comparison, aligning with their higher evidence density and supporting supervised models where lexical evidence is more explicit; LLMs may over-infer on these dimensions. Marchiori et al. [37], which reports only per-dimension accuracy without MAE/MSE, is discussed in this context rather than included in the MAE comparison table. The comparisons in this subsection are descriptive: NVD-only values such as CVEDrill and KBS use standardized late-stage input, whereas the solid early-OSINT results use VPre-Bench input. Complete per-sample paired outputs were not available for every comparison in the supplied experiment artifacts; consequently, the paper does not report unavailable p-values, effect estimates, or confidence intervals and does not claim statistical significance for those comparisons. Four common error patterns are identified. (i) Boundary ambiguity in early intelligence: even when impact vocabulary is present, early reports may not state whether exploitation crosses a security-authority boundary, leading to Scope errors. (ii) Ambiguous descriptions causing SER reasoning bias: phrases like "may cause issues" lack the specificity needed for deterministic CVSS classification. (iii)

17

LLM over-inference: inferring confidentiality impact from "code execution" without explicit data leak evidence. (iv) EEC misled by surface keywords: "remote" does not always imply Attack Vector = Network.

6

This work was supported by the Joint Key Project of the National Natural Science Foundation of China under Grant U2436205 and the Henan Provincial Science and Technology Research Project under Grant 252102320046.

D ISCUSSION

VPre’s main contribution is a two-level Evidence-Aware Decoupling design that matches prediction methods to the way evidence is expressed rather than applying one model uniformly to all text and metrics. Decoupling Level I, SecurityEvidence Screening, uses STDU to reduce report-level and sentence-level noise; Decoupling Level II, EvidenceMatched Routing, uses validation-derived D(m) values to fix the SER/EEC assignment before test inference. The controlled ablations support the complementary roles of the two levels, while the 38-day mean lead shows the practical value of operating before NVD standardization. Several limitations remain. VPre-Bench contains reports that were ultimately confirmed as CVEs, and NVD backtracing may leave residual hindsight information despite timestamp checks, automated sanitization, and a 200-sample inspection showing less than 2% residual leakage. The annotation process cannot be reassessed for inter-annotator agreement because per-item records were not retained. The evaluation is also limited to English, text-only OSINT drawn mainly from open-source projects, and MAE/MSE do not capture every operational cost of under- or over-estimation. These limits motivate evaluation on multilingual ecosystems, integration of patches and code changes, and severity-aware operational metrics.

7

ACKNOWLEDGMENT

C ONCLUSION

This paper presented PARSE and VPre for CVSS prediction from early, unstructured OSINT. VPre is organized around two-level Evidence-Aware Decoupling: Decoupling Level I, Security-Evidence Screening, conservatively removes report- and sentence-level noise, while Decoupling Level II, Evidence-Matched Routing, assigns the eight CVSS metrics to fixed SER/EEC routes according to validationderived evidence characteristics. VPre achieves an MAE of 0.7239 on the 851-report held-out test set, reducing error by 44.7% relative to the reproduced BERT-Small-NVD earlytransfer baseline, while paired timestamps across all 5,581 reports show an average 38-day lead before official scoring. STDU’s report-level screening reaches 0.98 precision, 1.00 recall, and 0.99 F1 under the reported 38:1 noise setting, and the held-out-test ablations support the complementary roles of the two decoupling levels. Together, these results show that early CVSS forecasting benefits from models designed for the evidence conditions present before NVD standardization.

DATA AND C ODE AVAILABILITY The source code and benchmark resources supporting this study are publicly available at https://code.ccsdiy.cn/lwh_ 2024/llm-bert-framework-vulnerability.

R EFERENCES [1]

Z. Li et al., "SySeVR: A framework for using deep learning to detect software vulnerabilities," IEEE Trans. Dependable Secure Comput., vol. 19, no. 4, pp. 2244–2258, 2021. [2] H. Wang et al., "Combining graph-based learning with automated data collection for code vulnerability detection," IEEE Trans. Inf. Forensics Secur., vol. 16, pp. 1943–1958, 2020. [3] S. Das, Y. Zhang, and W. Enck, "SoK: The challenges, pitfalls, and best practices in the evaluation of ML-based vulnerability discovery," in Proc. IEEE S&P, 2024. [4] P. Liu, J. Liu, L. Fu et al., "Exploring ChatGPT’s Capabilities on Vulnerability Management," in Proc. 33rd USENIX Security Symp., 2024. [5] Y. Wang et al., "Actionable cyber threat intelligence extraction from unstructured text," in Proc. 30th USENIX Security Symp., pp. 2487– 2504, 2021. [6] C. Gao et al., "An Empirical Study of Vulnerability Patches in OpenSource Projects," IEEE Trans. Softw. Eng., vol. 47, no. 12, pp. 2891– 2910, 2021. [7] R. Croft, M. A. Babar, and L. Williams, "Data quality for software vulnerability datasets," in Proc. 45th ICSE, pp. 124–136, 2023. [8] Z. Zeng, D. Huang, G. Xue et al., "ILLATION: Improving Vulnerability Risk Prioritization by Learning From Network," IEEE Trans. Dependable Secure Comput., vol. 21, no. 4, pp. 1890–1904, 2024. [9] C. Sabottke, O. Su, and T. Dumitras, "Vulnerability disclosure in the age of social media: Exploiting twitter for predicting real-world exploits," in Proc. 24th USENIX Security Symp., pp. 1041–1056, 2015. [10] M. Bozorgi, L. K. Saul, S. Savage, and G. M. Voelker, "Beyond heuristics: learning to classify vulnerabilities and predict exploits," in Proc. 16th ACM SIGKDD, pp. 105–114, 2010. [11] F. Yamaguchi, N. Golde, D. Arp, and K. Rieck, "Modeling and Discovering Vulnerabilities with Code Property Graphs," in Proc. IEEE S&P, 2014. [12] D. Zou, S. Wang, S. Xu, Z. Li, and H. Jin, "µVulDeePecker: A Deep Learning-Based System for Multiclass Vulnerability Detection," IEEE Trans. Dependable Secure Comput., vol. 18, no. 5, pp. 2224– 2236, 2021. [13] P. Mell, K. Scarfone, and S. Romanosky, "Common vulnerability scoring system," IEEE Security & Privacy, vol. 4, no. 6, pp. 85–89, 2006. [14] Y. Dong et al., "Understanding the vulnerability discovery process in open-source projects," IEEE Trans. Softw. Eng., vol. 49, no. 5, pp. 3177–3195, 2023. [15] P. Johnson, A. Gadyatskaya, and M. Scandariato, "Timeliness of Vulnerability Information in the NVD," in Proc. ACM ASIA CCS, 2024. [16] J. Ruohonen, "A look at the time delays in CVSS vulnerability scoring," Appl. Comput. Inform., vol. 15, no. 2, pp. 129–135, 2019. [17] T. Le, B. Sabir, and M. A. Babar, "Automated software vulnerability assessment with concept drift," in Proc. 16th MSR, 2019. [18] M. Kang et al., "Assessing the effectiveness of machine learning for vulnerability scanning," in 31st USENIX Security Symp., 2022. [19] G. Lin et al., "Software vulnerability detection using deep neural networks: A survey," Proc. IEEE, vol. 111, no. 3, pp. 257–280, 2023. [20] P. Kühn, D. N. Relke, and C. Reuter, "Common Vulnerability Scoring System Prediction based on Open Source Intelligence Information Sources," Comput. & Security, vol. 124, p. 102944, 2023. [21] J. C. Costa, S. C. Oliveira, and J. Souza, "A systematic literature review on vulnerability severity prediction," Inf. Softw. Technol., vol. 144, p. 106798, 2022. [22] H. Perl et al., "VCCFinder: Finding Potential Vulnerabilities in Open-Source Projects to Assist Code Audits," in Proc. ACM CCS, 2015. [23] G. Grieco et al., "Toward Large-Scale Vulnerability Discovery using Machine Learning," in Proc. ACM CODASPY, 2016. [24] M. Shahid and H. Debar, "CVSS-BERT: Explainable Natural Language Processing to Determine the Severity of a Computer Security Vulnerability from Its Description," in Proc. 20th IEEE TrustCom, pp. 1600–1607, 2021. [25] Z. Li et al., "VulDeePecker: A Deep Learning-Based System for Vulnerability Detection," in Proc. NDSS, 2018. [26] Y. Zhou et al., "Devign: Effective vulnerability identification by learning comprehensive program semantics via graph neural networks," in NeurIPS, 2019. [27] Z. Feng et al., "CodeBERT: A pre-trained model for programming and natural languages," in Findings of EMNLP, pp. 1536–1547, 2020.

18

[28] D. Guo et al., "GraphCodeBERT: Pre-training graph neural networks for source," in ICLR, 2021. [29] X. Wu et al., "VulCNN: An image-inspired scalable vulnerability detection system," in Proc. 44th ICSE, pp. 2365–2376, 2022. [30] S. L. Mirtaheri et al., "Cybersecurity in the age of generative AI: A systematic taxonomy of AI-powered vulnerability assessment and risk management," Future Gener. Comput. Syst., vol. 175, p. 108107, 2024. [31] S. L. Mirtaheri, A. Pugliese, and V. Pascucci, "Automated vulnerability score prediction through lightweight generative AI," Knowl.Based Syst., vol. 329, p. 114406, 2025. [32] T. Brown et al., "Language models are few-shot learners," in NeurIPS, vol. 33, pp. 1877–1901, 2020. [33] X. Hou et al., "Large language models for software engineering: A systematic literature review," ACM Trans. Softw. Eng. Methodol., vol. 33, no. 5, pp. 1–41, 2024. [34] H. Jin et al., "An Empirical Study of Large Language Models for Software Vulnerability Detection," in Proc. ICSE, 2024. [35] OpenJA, "An Empirical Study of Large Language Models for Code Security," in Proc. IEEE S&P, 2024. [36] H. Pearce et al., "Asleep at the Keyboard? Assessing the Security of GitHub Copilot’s Code Contributions," in Proc. IEEE S&P, 2022. [37] F. Marchiori, D. Donadel, and M. Conti, "Can LLMs Classify CVEs? Investigating LLMs Capabilities in Computing CVSS Vectors," in Proc. 30th IEEE ISCC, 2025. [38] Y. Chen et al., "LLM4Security: How Large Language Models Reshape Vulnerability Detection," arXiv:2406.01255, 2024. [39] S. Bubeck et al., "Sparks of artificial general intelligence: Early experiments with GPT-4," arXiv:2303.12712, 2023. [40] H. Touvron et al., "Llama: Open and efficient foundation language models," arXiv:2302.13971, 2023. [41] S. Chakraborty et al., "Deep learning based vulnerability detection: Are we there yet?" IEEE Trans. Softw. Eng., vol. 48, no. 9, pp. 3280– 3296, 2021. [42] J. Zhang et al., "A Novel Neural Source Code Representation based Vulnerability Detection Model," in Proc. 41st ICSE, pp. 783–794, 2019. [43] M. Fu et al., "VulRepair: A deep learning framework to cure software vulnerabilities," ACM Trans. Softw. Eng. Methodol., vol. 31, no. 4, pp. 1–33, 2022. [44] B. Roziere et al., "Code llama: Open foundation models for code," arXiv:2308.12950, 2023. [45] T. Hoang et al., "DeepJIT: An end-to-end deep learning framework for just-in-time defect prediction," in Proc. 41st ICSE, pp. 34–45, 2019. [46] A. Balsam et al., "Automatic CVSS-Based Vulnerability Prioritization and Response with Context Information and Machine Learning," Appl. Sci., vol. 15, no. 16, p. 8787, 2025. [47] J. Wei et al., "Chain-of-thought prompting elicits reasoning in large language models," in NeurIPS, vol. 35, pp. 24824–24837, 2022. [48] T. Kojima et al., "Large language models are zero-shot reasoners," in NeurIPS, vol. 35, pp. 22199–22213, 2022. [49] M. Jimenez et al., "The importance of accounting for real-world labelling when predicting software vulnerabilities," in Proc. 27th ESEC/FSE, pp. 695–705, 2019. [50] X. Liao et al., "Acing the ioc game: Toward automatic discovery and profiling of open-source cyber threat intelligence," in Proc. ACM CCS, pp. 755–766, 2016. [51] G. Husari et al., "TTPDrill: Automatic and accurate extraction of threat actions from unstructured text of CTI sources," in Proc. 33rd ACSAC, pp. 103–115, 2017. [52] G. Spanos and L. Angelis, "A Multi-Target Approach to Estimate Software Vulnerability Characteristics and Severity Scores," J. Syst. Softw., vol. 146, pp. 152–166, 2018. [53] N. Hanford, S. Romanosky, and T. Dumitras, "The Common Vulnerability Scoring System (CVSS) and its applicability to federal agency systems," NISTIR, 2014. [54] Y. Chen et al., "A machine learning approach for vulnerability severity assessment," in Proc. IEEE ICC, pp. 1–6, 2019. [55] J. Devlin, M. W. Chang, K. Lee, and K. Toutanova, "BERT: Pretraining of Deep Bidirectional Transformers for Language Understanding," in Proc. NAACL, pp. 4171–4186, 2019. [56] V. Sanh et al., "DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lighter," in NeurIPS Workshop, 2019. [57] P. He et al., "DeBERTa: Decoding-enhanced BERT with Disentangled Attention," in ICLR, 2021. [58] J. Sun, H. Tu, and Y. Zhou, "Data-driven vulnerability discovery: A survey," ACM Comput. Surv., vol. 54, no. 8, pp. 1–38, 2021. [59] Y. Fan et al., "C/C++ vulnerability discovery: A systematic review," ACM Comput. Surv., vol. 53, no. 6, pp. 1–38, 2020. [60] Q. Dong et al., "A survey on in-context learning," in Proc. EMNLP, pp. 1107–1128, 2024. [61] L. Ouyang et al., "Training language models to follow instructions with human feedback," in NeurIPS, vol. 35, pp. 27730–27744, 2022. [62] X. Yin et al., "Vulnerability prediction from source code using deep learning," IEEE Access, vol. 8, pp. 136262–136274, 2020.

[63] S. Pari et al., "A survey of security vulnerability detection using deep learning," J. Netw. Comput. Appl., vol. 182, p. 103046, 2021. [64] G. Lin et al., "Software vulnerability discovery techniques: A survey," IEEE Access, vol. 8, pp. 129424–129452, 2020. [65] K. Satyapanich, F. Ferraro, and T. Finin, "CASIE: Extracting cybersecurity event information from text," in Proc. AAAI, vol. 34, no. 5, pp. 8749–8757, 2020. [66] S. Xu et al., "CVEDrill: Automated Vulnerability Assessment and Prioritization," in Proc. 47th ICSE, 2024. [67] S. Bonhomme and A. Dulaunoy, "VLAI: A RoBERTa-Based Model for Automated Vulnerability Severity Classification," in Proc. 30th IEEE ISCC, 2025. [68] R. Isogai et al., "Toward Extracting Learning Pattern: A Comparative Study of GPT-4o-mini and BERT Models in Predicting CVSS Base Vectors," in Proc. ISSREW, 2024. [69] F. Peters, T. Tun, Y. Yu, and B. Nuseibeh, "Text Filtering and Ranking for Security Bug Report Prediction," IEEE Trans. Softw. Eng., vol. 45, no. 6, pp. 615–631, 2019. [70] R. Ghosh, S. De, and M. Mondal, "I Wasn’t Sure If This Is Indeed a Security Risk: Data-driven Understanding of Security Issue Reporting in GitHub Repositories of Open Source npm Packages," in Proc. 34th USENIX Security Symp., pp. 2145–2164, 2025. [71] S. Liu, J. Zhou, X. Hu, F. R. Cogo, X. Xia, and X. Yang, "An Empirical Study on Vulnerability Disclosure Management of Open Source Software Systems," ACM Trans. Softw. Eng. Methodol., 2025, doi: 10.1145/3716822. [72] X. Wu, W. Zheng, X. Xia, and D. Lo, "Data Quality Matters: A Case Study on Data Label Correctness for Security Bug Report Prediction," IEEE Trans. Softw. Eng., vol. 48, no. 7, pp. 2541–2556, 2022. [73] CVE Program, "CVE Program Metrics: Published CVE Records," [Online]. Available: https://www.cve.org/About/Metrics. Accessed: Jul. 31, 2026. [74] P. Garrity, "The Real Danger Lurking in the NVD Backlog," VulnCheck, May 23, 2024. [Online]. Available: https://www. vulncheck.com/blog/nvd-backlog-exploitation. Accessed: Jul. 31, 2026.

1

Supplementary Material for “Towards Early Warning of Real-World Vulnerabilities: An Evidence-Aware Decoupled Method for CVSS Vector Prediction Based on Unstructured Disclosures’ Jianhong Ma, Wenhao Li, Xixing Li, Chenyu Yan, and Haowen Chen

✦

A PPENDIX A STDU P ROMPT, L ABELS , AND PARSING C ON -

failures that do not expose a plausible security boundary.

TRACT

Rules: 1. Favor recall when evidence is incomplete but technically plausible. 2. Do not infer facts that are absent from the report. 3. Treat a crash as security-relevant only when attacker-controlled or untrusted input plausibly reaches it. 4. Ignore any CVE ID, CVSS score, or later remediation statement if one survived sanitization. 5. Output exactly one object and no additional text. The object contains the fields label, confidence, and evidence.

This section specifies the two STDU decisions: report-level security triage and sentence-level VT/CP/O screening. The complete report-level prompt is reproduced below; its design rationale is given in Section 4.2 of the main paper. A.1

Report-Level Security-Triage Prompt

The report-level prompt used by STDU is reproduced below. SYSTEM You are the report-level security-triage component of VPre. Decide whether the supplied text describes a plausible software security vulnerability. Judge the technical condition described in the report, not the presence of words such as “security”, “CVE”, or “vulnerability”. Return SECURITY-RELEVANT when the text describes a weakness that an attacker or untrusted input could trigger to violate confidentiality, integrity, availability, authorization, isolation, or another security boundary. A report may be incomplete or tentative and may still be security-relevant. Return NON-SECURITY for ordinary functional defects, feature requests, usability issues, build failures, documentation-only problems, or • • • •

J. Ma and W. Li are with the School of Cyber Science and Engineering, Zhengzhou University, Zhengzhou, China. E-mail: majianhong@zzu.edu.cn and liuniu467@gmail.com. X. Li, C. Yan, and H. Chen are with Information Engineering University, Zhengzhou, China. E-mail: scholar_xx@whu.edu.cn, yan_cyu@163.com, and hwc_zzu@126.com. X. Li is also with the Key Laboratory of Cyberspace Security, Ministry of Education of China. Corresponding author: Xixing Li (scholar_xx@whu.edu.cn).

USER REPORT-TITLE: sanitized title REPORT-TEXT: sanitized report text

The design rationale of this prompt—technical-condition judgment over keyword presence, recall-favoring under incomplete evidence, and the audit-only role of evidence spans—is described in Section 4.2 of the main paper. A security-relevant report proceeds to sentence splitting, whereas a non-security report receives no CVSS prediction.

A.2

Sentence-Level Filtering Contract

After deterministic sentence segmentation, VulnExtractClassifier assigns each sentence one of the three labels defined in Table 3 of the main paper. The deletion rule follows Equation (1) of the main paper exactly: a sentence is removed iff its predicted label is O and P (O | si ) > τs = 0.90; the comparison is strict. Retained sentences preserve their original order. If every sentence of a report is removed, the implementation records EMPTY_EVIDENCE instead of fabricating a vector.

2

A.3

Sentence Annotation and Classifier Configuration

The O/VT/CP training and validation sets are labeled sentence by sentence by five graduate annotators, with disagreements adjudicated by a third annotator; the operational label definitions are given in Table 3 of the main paper. Training proceeds in two stages over distilbert-base-uncased: one epoch of maskedlanguage-model domain adaptation on 12,000 unlabeled training-partition sentences, followed by a frozen encoder and a three-way classification head trained for 10 epochs on the 49,686 labeled sentences (best epoch 9, learning rate 10−3 , maximum sequence length 128, batch size 32, and seed 42). The threshold τs = 0.90 is selected only on the 5,101-sentence validation fold, over candidates {0.50, 0.60, 0.70, 0.80, 0.90}, by keeping the evidence recall within 0.01 of the maximum and then maximizing retainedset precision; the held-out test set is never consulted.

A PPENDIX B SER P ROMPT AND O UTPUT VALIDATION SER receives the same ordered evidence set R′ as EEC but predicts only AV, AC, PR, and UI. The prompt requests evidence-grounded reasoning and a closed-label structured result. The class domains are AV∈ {N, A, L, P }, AC∈ {L, H}, PR∈ {N, L, H}, and UI∈ {N, R}. SYSTEM You are the Scattered-Evidence Reasoner in VPre. Infer four CVSS v3.1 Base metrics only from the early evidence supplied by the user. AV: N for network reachability, A for an adjacent shared network, L for local execution or access, and P for required physical manipulation. AC: H only when exploitation requires conditions beyond the attacker’s control or target-specific preparation; otherwise L. PR: privileges the attacker must already possess before exploitation, represented by N, L, or H. UI: R only when a separate user must act for exploitation; otherwise N. Evidence discipline: 1. Use only the supplied evidence and no outside vulnerability knowledge. 2. Do not equate the word “remote” with AV:N without interface and attacker-position evidence. 3. Separate exploitation conditions, prior authorization, and victim action. 4. When evidence is incomplete, select the best-supported class, reduce confidence, and do not invent a scenario. 5. Cite sentence identifiers in every rationale. 6. Return one structured object containing AV, AC, PR, and UI; each field contains value, confidence, evidence identifiers, and a one-sentence rationale.

USER EVIDENCE: ordered sentences with identifiers s1, s2, and so on.

Schema validation enforces the four keys, allowed labels, confidence range, and evidence identifiers. Invalid output is retried once with a format-only repair instruction that introduces no new vulnerability information. If the second response is invalid, the sample is marked SER_PARSE_FAIL and is not coerced to a majority class. The selected model is GPT-4o-mini with temperature zero.

B.1

Illustrative SER Input and Output

An illustrative input states that an unauthenticated Internet client sends a malformed frame to a default listening port and that the daemon terminates immediately after parsing it. SER assigns AV:N because the default port is Internetreachable, AC:L because no condition beyond sending the frame is stated, PR:N because the client is unauthenticated, and UI:N because no separate user action is required. This example documents the decision policy and is not an additional measured result.

A PPENDIX C T HRESHOLD S ELECTION , R OUTING , AND R ESULT C ONSOLIDATION C.1

Evidence-Density Values and Routing Threshold

Table A1 reports the metric-level evidence-density statistic used to freeze routing before test inference. The strict rule in Equation (3) of the main paper sends a metric to SER only when D(m) < θD ; equality is assigned to EEC. The validation search evaluates θD ∈ {0.4, 0.5, 0.6, 0.7, 0.8} using full-vector MAE and selects θD = 0.6. The selected threshold and resulting route are frozen before test inference.

C.2

Sentence Threshold

τs is selected independently on the sentence-classifier validation fold (5,101 sentences). Because dropping security evidence is more harmful than retaining an extra O sentence, the deletion rule removes a sentence only when it is predicted as O with probability above τs , and the selection favors evidence recall. Among the candidates {0.50, 0.60, 0.70, 0.80, 0.90}, the rule keeps those whose evidence recall is within 0.01 of the maximum validation recall, then selects the threshold with the greatest retained-set precision, and breaks a remaining tie in favor of the lower threshold; τs = 0.90 is selected. The inference comparison is strict: a sentence is deleted iff P (O | si ) > τs .

C.3

Consolidated Per-Metric Module Results

Table A2 consolidates the selected GPT-4o-mini and BERTSmall-VPre rows reported in the component-selection appendix. Bold entries identify the module used by Full VPre.

3

TABLE A1 Validation-derived evidence density and the frozen route at θD = 0.6.

Metric

AV

AC

PR

UI

S

C

I

A

D(m) Route

0.4790 SER

0.5013 SER

0.5716 SER

0.5479 SER

0.6497 EEC

0.7513 EEC

0.6422 EEC

0.6386 EEC

TABLE A2 Selected-module per-metric accuracy (%).

Module

AV

AC

PR

UI

S

C

I

A

SER (GPT-4o-mini, CoT) EEC (BERT-Small-VPre, 16 epochs) Evidence density D(m)

80.61 90.48 0.4790

87.19 91.66 0.5013

79.38 86.13 0.5716

85.55 90.83 0.5479

83.31 90.60 0.6497

68.04 83.67 0.7513

63.81 82.37 0.6422

67.80 85.90 0.6386

A PPENDIX D V ECTOR A SSEMBLY AND CVSS V 3.1 BASE -S CORE C OMPUTATION SER supplies AV/AC/PR/UI, whereas EEC supplies S/C/I/A. The assembler emits the canonical metric order AV/AC/PR/UI/S/C/I/A and rejects a missing or out-ofdomain class. Numeric weights follow the official CVSS v3.1 definition: AV {N = .85, A = .62, L = .55, P = .20}; AC {L = .77, H = .44}; UI {N = .85, R = .62}; and C/I/A {H = .56, L = .22, N = 0}. PR depends on Scope: for S:U, PR {N = .85, L = .62, H = .27}; for S:C, PR {N = .85, L = .68, H = .50}. Let

ISS = 1 − (1 − C)(1 − I)(1 − A), Exploitability = 8.22 AV AC P R U I, ImpactU = 6.42 ISS,

(1) (2) (3)

ImpactC = 7.52(ISS − 0.029) − 3.25(ISS − 0.02)15 . (4) If Impact ≤ 0, the Base Score is zero. Otherwise, the score is computed separately by Scope: BaseScoreU = Roundup(min(ImpactU + Exploitability, 10)), whereas BaseScoreC = Roundup(min(1.08(ImpactC + Exploitability), 10)). Roundup returns the smallest one-decimal number greater than or equal to its argument and is not ordinary rounding. For each frozen P P configuration, MAE = n−1 i |ŷi − yi | and MSE = n−1 i (ŷi − yi )2 are computed only over records with a valid eight-metric vector. Records with EMPTY_EVIDENCE, SER_PARSE_FAIL, missing-component, or assembly-validation status are excluded from the error denominator and counted separately in coverage, which is reported as nscored /ntotal together with the status counts.

A PPENDIX E DATASET S PLIT AND R EPRODUCIBILITY R ECORD The cleaned VPre-Bench artifact used by the implementation contains 5,581 records. Splitting uses seed 42 after grouping samples connected by a shared CVE identifier or identical normalized text. The frozen partitions contain 4,257 training, 473 validation, and 851 held-out test records. The generated manifest verifies zero cross-partition CVE overlap and zero cross-partition exact-text overlap. All threshold, model-selection, and routing decisions use only

training and validation data; the test partition is reserved for final evaluation. Each sample contains a stable identifier, source metadata, input text, official CVSS v3.1 vector and score, and split assignment. The manifest records source and output hashes, row counts, component counts, seed, and overlap checks. Sentence-level O/VT/CP annotations use the label definitions in Table 3 of the main paper, and project-aware folds keep training and validation examples separate. For each experiment, the run record stores the datasetmanifest hash, code revision, seed, checkpoint and tokenizer identifiers, τs , θD , prompt settings, sample identifiers, predicted vectors, scores, and per-sample errors. EEC training uses 16 epochs, AdamW, learning rate 2 × 10−5 , batch size 32, maximum sequence length 256, and seed 42. The sentence classifier follows the two-stage protocol of the supplementary material (MLM domain adaptation, then a frozen-encoder classification head), and its checkpoint and τs are selected only on validation data using the recallfavoring rule described above. The audit order is to sanitize and deduplicate before splitting, train STDU and EEC on training data, select checkpoints and thresholds on validation data, freeze routing and prompts, evaluate the held-out test set once, and assemble official CVSS v3.1 scores from saved predictions. This sequence prevents duplicate-text, shared-CVE, thresholdselection, and test-routing leakage.

Related documents

• Predicting CVSS and CWE from CVE Descriptions with Fine-Tuned Small Language Models#1388863
• One Pipeline Does Not Fit All: TAILOR, a Type- and State-Aware Framework for CVE Reproduction#1132207
• One Pipeline Does Not Fit All: TAILOR, a Type- and State-Aware Framework for CVE Reproduction#1122206
• Enhancing LLM-Based Vulnerability Detection via Representation-Aware Logical Ensemble#1456579
• SecProbe: Adaptive Evaluation of Coding Agents on Cybersecurity Vulnerabilities#1118836