Vulnerability Abundance: A formal proof of infinite vulnerabilities in code

Eireann Leverett, Jeroen van der Ham-de Vos

We present a constructive proof that a single C program, the \emph{Vulnerability Factory}, admits a countably infinite set of distinct, independently CVE-assignable software vulner…