Knowledge-Enhanced Agentic Vulnerability Repair

2026-07-01

AI Summary

Existing automated program repair approaches struggle to precisely identify root causes and underutilize historical repair knowledge. This work proposes KeaRepair, a knowledge-enhanced, agent-driven repair framework that uniquely integrates multidimensional historical vulnerability knowledge with tool-augmented ReAct-style reasoning to establish a closed-loop, knowledge-driven process for both diagnosis and patch generation. By combining a multi-perspective knowledge base, retrieval-augmented generation, and a multi-layer validation mechanism leveraging compilation, proof-of-concept exploits, and test suites, KeaRepair achieves cross-language generalization. Evaluated on 55 real-world C/C++ vulnerabilities, it attains a repair rate of 83.64% (46/55), including six unique cases that baseline methods fail to resolve.

Abstract

Frontier foundation models have changed the math on vulnerability discovery, but the bigger challenge is how the remediation side keeps up. Despite recent progresses in Automated Vulnerability Repair (AVR), current solutions struggle to reliably identify the root causes of vulnerabilities, and insufficiently utilize the prior fix knowledge to guide the patch generation process, thus undermining their effectiveness in practice. To address this gap, we propose KeaRepair, a novel agentic AVR approach that grounds patch generation in verified program facts and high-level vulnerability knowledge. Specifically, KeaRepair first extracts multi-dimensional vulnerability knowledge from historical vulnerability-patch pairs from dual complementary views, and constructs dedicated retrieval knowledge bases. It then employs a tool-augmented agent that performs ReAct-style reasoning to collect verified program facts for vulnerability diagnosis. Finally, based on the diagnostic results, KeaRepair performs knowledge-level retrieval-augmented patch generation and iteratively refines patches through a closed-loop validation process involving compilation, PoC replay, and test-suite execution. Experimental results show that KeaRepair significantly outperforms existing AVR approaches on 55 reproducible C/C++ vulnerabilities. When paired with Gemini-3.1-Pro, KeaRepair successfully repairs 46 vulnerabilities, achieving a repair rate of 83.64%. Moreover, KeaRepair fixes six unique vulnerabilities that none of the baselines can address, and further demonstrates strong cross-language generalizability.

Problem

• Automated Vulnerability Repair
• root cause identification
• fix knowledge utilization
• patch generation
• vulnerability remediation

Innovation

• Knowledge-Enhanced Repair
• Agentic Reasoning
• Retrieval-Augmented Generation
• Automated Vulnerability Repair
• Closed-Loop Validation