Tracing C/C++ Reuse Through Intermediate Projects Found 48 Unpatched Vulnerabilities, 23 Now Fixed

arXiv 2609.17018·medium signalXBlueskyLinkedInCopy link

GANADI (arXiv 2609.17018, submitted 15 Sep 2026) builds OSS reuse genealogies by clustering downstream projects on shared characteristics of origin-derived 'pivotal functions' and then inferring reuse direction within each cluster, addressing the gap where existing tools identify reused components but cannot trace reuse paths through intermediate projects. Applied to 20 widely reused OSS projects with over 1,500 propagation paths it hit 84.85% precision and 95.76% recall, against at most 23.21% recall for existing approaches. Using the genealogy for vulnerability detection surfaced 48 unpatched vulnerabilities in popular real-world C/C++ projects, of which 23 were patched after responsible disclosure with one CVE assigned.