RustGo Prunes 78.5% of Fuzzing Paths by Targeting Only Unsafe Rust, Finding 13 Unknown Bugs Including One CVE

arXiv 2608.05870·medium signalXBlueskyLinkedInCopy link

RustGo (arXiv 2608.05870, Aug 6) observes that unsafe code is roughly 10% of a typical Rust codebase, yet existing fuzzers spend budget on safe Rust whose memory safety the compiler already enforces. Using Rust-specific static analysis to identify potential memory-bug targets and prune irrelevant paths, RustGo prunes 78.49% of paths on average, reaches targets 2.09x to 5.08x faster than existing fuzzers, and found 13 previously unknown bugs across real-world Rust applications — six with assigned RUSTSEC IDs and one with a CVE. Concrete evidence that directed fuzzing pays off where the language already gives you a safety boundary to aim at.