CLADFuzz

A probabilistic destructive path also permits malformed candidates. Across 3,000 native-extension DOCX/XLSX/PPTX samples, HardValidity predicts Office ad mission with 96.3% precision and 99.8% recall. Sole-new violation realization is 99.8% for DOCX, 98.9% for XLSX, and 100% for PPTX under the modeled evaluator.

Across ten independent runs compared over the first 20 hours, CLAD Fuzz’s median post-initial occupied edge-map-slot gain is 3.6× 17.6× that of AFL++/Nyx or OpenXMolar/Nyx (Holm-adjusted p <0.001). A one-year Microsoft 365 Apps campaign produced ten vendor-confirmed, patched CVEs.</p><p dir="ltr"><b>CLADFuzz Design</b></p><p dir="ltr">CLADFuzz models OOXML packages as <b>Reference Constraint Graphs</b> and combines dependency-aware rewriting with a seed-captured <i>PackageContract</i> to maintain structural validity while enabling precise consistency mutations.</p><ul><li><b>HardValidity</b>: A structure-aware gating mechanism that filters out structurally invalid inputs before they are sent to the target application</li><li><b>TargetViolation</b>: A control predicate for targeted consistency mutation, which isolates exactly one requested soft-constraint violation per generated input</li><li>A bounded destructive channel to retain malformed inputs for broader exploration of parser boundary behavio</li></ul><p dir="ltr"><b>Contents of This Deposit</b></p><ol><li>Full source code of the CLADFuzz fuzzing framework</li><li>A curated benchmark corpus of 300 native-extension DOCX, XLSX, and PPTX seed samples</li><li>Experiment configuration files and run scripts for comparative testing with AFL++/Nyx and OpenXMolar/Nyx</li><li>Proof-of-concept samples for the 10 vendor-confirmed CVEs (all vulnerabilities have been patched by Microsoft)</li></ol><p dir="ltr"><b>Citation</b></p><p dir="ltr">Please cite the associated research paper when using this framework or dataset in your work.</p>