TaL2V: Combining LLM With Binary Taint Analysis for Vulnerability Detection

With the continuous advancement of binary code analysis technology, traditional taint analysis methods face multiple challenges, especially in the case of missing symbol information, which leads to a significant decrease in the efficiency and accuracy of vulnerability detection. To address this problem, this paper proposes an innovative vulnerability detection method, Taint with LLM to Vulnerability (TaL2V), which recovers binary code semantics through function‐name prediction and optimizes the LLM reasoning process by combining the concept of a chain to achieve automated taint propagation path tracking and vulnerability verification. The experimental results show that TaL2V outperforms existing binary taint analysis methods (e.g., LATTE and Emtaint) in terms of accuracy and F1 score. Although the detection accuracy of TaL2V is slightly lower for some complex vulnerability types (e.g., CWE‐190 and CWE‐606), it performs well in binary file analysis without symbolic information, with strong robustness and wide application potential. The successful detection of 131 vulnerabilities in real firmware shows that the method can greatly help analysts identify and fix vulnerabilities.