Predicting CVSS and CWE from CVE Descriptions with Fine-Tuned Small Language Models

Tara Dixit; Jessie Dong; Summer Li

cs.LGOct 16, 2026

Predicting CVSS and CWE from CVE Descriptions with Fine-Tuned Small Language Models

Authors: Tara Dixit, Jessie Dong, Summer Li

Organizations: Stanford University

Abstract

Until April 2026, the National Vulnerability Database labeled nearly every published Common Vulnerabilities and Exposures (CVE) entry with a Common Vulnerability Scoring System (CVSS) v3.1 vector, a severity tier, and a Common Weakness Enumeration (CWE) weakness type. Now, NIST enriches only the high priority CVEs, leaving many newly published vulnerabilities unlabelled with the classifiers that security teams use for patch triage. In CVE enrichment, we predict the eight base components of CVSS v3.1 vector, base score, severity tier, and CWE from the vulnerability's textual description alone. To prevent leakage between near-duplicate descriptions, all systems are trained only on CVEs published in 2022 and 2023. Results are evaluated on all 36,325 usable 2024 CVEs in the pinned NVD snapshot. All scores are either directly predicted, or calculated from predicted vectors using the CVSS formula. A fine-tuned 3.8B-parameter model Phi-3.5-mini, trained with LoRA in 2.5 hours on a single Apple M5 Pro chip, achieves 69.9% accuracy on severity and 70.9% on CWE. It matches the official vector exactly for 48.8% of test CVEs, outperforming TF-IDF logistic regression by 2.8 to 4.7 points on all accuracy metrics based on zero-exclusion paired bootstrap intervals. When we evaluate the base model with a zero-shot prompt, it achieves 20.8% accuracy on severity in a sample of 2,000 CVEs. In this same sample, its stated scores match its own vector precisely for only 3.4% of CVEs. However, deriving scores from predicted vectors boosts the critical recall of TF-IDF logistic regression from 50.7% to 73.3% with no additional cost. And since the errors of the fine-tuned model and TF-IDF affect different CVEs, at least one system matches the correct severity tier for 75.8% of test CVEs.

Figures & tables

Panel of Figure 1 — Figure 1: Two CVE descriptions from the 2024 test set and the labels NIST assigned to them. Left: an out-of-bounds write, CWE-787, which the CWE hierarchy places under the buffer-overflow class CWE-119. Right: a use-after-free in Chrome that is exploitable over the network once a user opens a crafted page.

System	Severity acc.	Severity macro-F1	CWE acc.	Score MAE $\downarrow$	Exact CVSS
TF-IDF + LR	67.1	47.9	67.2	0.98	44.1
TF-IDF + CB-LR	65.7	51.9	67.2	0.98	40.5
TF-IDF + RF	66.9	47.1	65.2	0.98	41.8
Fine-tuned Phi-3.5	69.9	55.7	70.9	0.85	48.8
TF-IDF + LR ⋄	67.1	51.6	67.2	0.94	44.1
TF-IDF + CB-LR ⋄	67.1	53.9	67.2	0.98	40.5

Table 1: Results on enriching test (2024) CVEs. Systems marked ⋄ predict CVSS scores by predicting vectors and computing the score using the CVSS formula. For each scoring method, bold highlights the best performing system and underline indicates second best. See Table 7 for all results.

	Both correct	Fine-tuned only	TF-IDF only	Neither	At least one
Severity	61.3	8.6	5.9	24.2	75.8
CWE	64.4	6.5	2.9	26.2	73.8
Exact CVSS vector	39.7	9.1	4.5	46.7	53.3

Table 2: Agreement between fine-tuned Phi-3.5 and TF-IDF logistic regression (formula scoring) on the 2024 test set (%). The last column is the share of CVEs on which at least one of the two is correct.

	Critical		High		Medium		Low
System	Rec.	F1	Rec.	F1	Rec.	F1	Rec.	F1
TF-IDF + LR, direct	50.7	51.4	62.2	61.1	77.9	77.1	1.1	2.2
TF-IDF + LR, formula	73.3	56.1	62.6	62.6	71.3	76.8	6.2	10.9
TF-IDF + LR bal., formula	57.1	52.8	61.9	62.2	75.6	77.2	19.2	23.2
Phi-3.5 + LoRA, formula	76.9	59.7	63.6	64.6	75.1	79.0	11.4	19.6

Table 3: Recall and F1 (%) by true severity tier on the 2024 test set.

Figure 2: Severity confusion matrices on the 2024 test set, normalized by true tier, for TF-IDF logistic regression with formula scoring (left) and fine-tuned Phi-3.5 (right).

Figure 3: Accuracy per CVSS component on 2024 CVEs. TF-IDF and the fine-tuned model are scored on the full test set, the zero-shot model on its 2,000-CVE sample.

Figure 4: CWE accuracy on the 2024 test set against the number of training examples with each CWE, for every CWE with at least 20 test CVEs. Point size grows with test count.

Figure 5: Distribution of predicted and NVD base scores on the 2024 test set in bins of 0.25, for ridge regression (left), TF-IDF logistic regression with formula scoring (middle), and the fine-tuned model (right).

	Severity		CWE	Score	Vector
System	Acc.	Macro-F1	Acc.	MAE $\downarrow$	Partial	Exact
TF-IDF + LR, formula	65.3 $\pm$ 2.1	47.6 $\pm$ 1.8	66.2 $\pm$ 2.2	0.99 $\pm$ 0.06	86.5 $\pm$ 0.7	42.2 $\pm$ 2.2
Phi-3.5 zero-shot, direct	20.8 $\pm$ 1.7	15.4 $\pm$ 2.4	25.7 $\pm$ 2.0	1.58 $\pm$ 0.05	60.5 $\pm$ 0.7	2.4 $\pm$ 0.6
Phi-3.5 zero-shot, formula	43.5 $\pm$ 2.3	26.8 $\pm$ 1.7	25.7 $\pm$ 2.0	2.08 $\pm$ 0.08	60.5 $\pm$ 0.7	2.4 $\pm$ 0.6
Phi-3.5 + LoRA, formula	69.6 $\pm$ 2.0	52.8 $\pm$ 3.3	68.8 $\pm$ 2.1	0.87 $\pm$ 0.05	87.5 $\pm$ 0.7	48.0 $\pm$ 2.1

Table 4: Comparison on the same random sample of 2,000 test CVEs, on which every system is scored.

Model	Valid JSON	Score = formula	Severity = tier of score
Phi-3.5 zero-shot	99.7	3.4	37.0
Phi-3.5 + LoRA	100.0	99.8	100.0

Table 5: Self-consistency of language-model outputs (%), where Score = formula is the share of outputs whose written score equals the CVSS v3.1 score of the written vector and Severity = tier of score is the share whose written severity matches the tier of the written score.

Appendix figures & tables16 assets

Supplementary material from the paper’s appendix.

Appendix

Split	CVEs	Critical	High	Medium	Low	CWEs
Train (2022–23)	40,436	15.4	39.3	43.7	1.7	464
Validation (2022–23)	10,109	15.4	39.3	43.7	1.7	293
Test (2024)	36,325	13.2	36.2	48.6	1.9	512

Appendix

Table 6: Data splits, with severity columns giving the share of CVEs (%) in each tier.

	Severity		CWE	Score	Vector
System	Acc.	Macro-F1	Acc.	MAE $\downarrow$	Partial	Exact
TF-IDF + LR, direct	67.1 $\pm$ 0.5	47.9 $\pm$ 0.6	67.2 $\pm$ 0.5	0.98 $\pm$ 0.01	86.9 $\pm$ 0.2	44.1 $\pm$ 0.5
TF-IDF + LR, formula	67.1 $\pm$ 0.5	51.6 $\pm$ 0.8	67.2 $\pm$ 0.5	0.94 $\pm$ 0.01	86.9 $\pm$ 0.2	44.1 $\pm$ 0.5
TF-IDF + LR balanced, direct	65.7 $\pm$ 0.5	51.9 $\pm$ 0.8	67.2 $\pm$ 0.5	0.98 $\pm$ 0.01	86.0 $\pm$ 0.2	40.5 $\pm$ 0.5
TF-IDF + LR balanced, formula	67.1 $\pm$ 0.5	53.9 $\pm$ 0.9	67.2 $\pm$ 0.5	0.98 $\pm$ 0.01	86.0 $\pm$ 0.2	40.5 $\pm$ 0.5
TF-IDF + RF, direct	66.9 $\pm$ 0.5	47.1 $\pm$ 0.6	65.2 $\pm$ 0.5	0.98 $\pm$ 0.01	86.1 $\pm$ 0.2	41.8 $\pm$ 0.5

Appendix

Table 7: All systems on the full 2024 test set (36,325 CVEs). Values are percentages except score MAE.

\pm

gives the half-width of the 95% bootstrap interval. Bold marks the best value in each column. The TF-IDF direct systems share one ridge regression, so their score MAE is identical.

Metric	Difference	95% interval
Severity accuracy (points)	+2.8	[+2.4, +3.1]
Severity macro-F1 (points)	+4.1	[+3.0, +5.2]
CWE accuracy (points)	+3.7	[+3.4, +4.0]
Score MAE	-0.09	[-0.10, -0.08]
Exact CVSS vector (points)	+4.7	[+4.3, +5.0]

Appendix

Table 8: Fine-tuned Phi-3.5 minus TF-IDF logistic regression with formula scoring, on the same 36,325 test CVEs, with 95% paired bootstrap intervals.

Component	Value	NVD	Fine-tuned
Attack vector	Network	76.2	79.2
	Adjacent	2.9	0.9
	Local	20.1	19.5
	Physical	0.7	0.4
Attack complexity	Low	94.3	98.2
	High	5.7	1.8

Appendix

Table 9: Share of 2024 test CVEs (%) with each value of each CVSS v3.1 component, as assigned by NIST and as predicted by the fine-tuned model.

Component	Fine-tuned	TF-IDF
Attack vector	7	7
Attack complexity	6	4
Privileges required	38	38
User interaction	12	10
Scope	5	5
Confidentiality	10	12

Appendix

Table 10: Which component is wrong when exactly one of the eight is wrong (% of such CVEs), for the fine-tuned model and TF-IDF logistic regression on the 2024 test set.

	Severity correct	0 wrong	1 wrong	2 wrong	3+ wrong
Fine-tuned Phi-3.5	69.9	48.8	13.1	4.9	3.2
TF-IDF + LR, formula	67.1	44.1	14.6	5.3	3.1

Appendix

Table 11: CVEs whose severity is predicted correctly, split by how many of the eight vector components are wrong (% of all 2024 test CVEs). Severity can be right while the vector is not, and most such CVEs have exactly one wrong component.

CVE	Description	NVD	Predicted	Wrong
CVE-2024-0003	A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privileged access.	7.2 High, CWE-269	9.8 Critical, CWE-287	PR
CVE-2024-0008	Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access.	8.8 High, CWE-613	9.8 Critical, CWE-613	UI
CVE-2024-0257	RoboDK v5.5.4 is vulnerable to heap-based buffer overflow while processing a specific project file. The resulting memory corruption may crash the application.	3.3 Low, CWE-122	7.8 High, CWE-787	C, I, A
CVE-2024-10214	Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings.	3.5 Low, CWE-303	9.8 Critical, CWE-287	PR, UI, C, I, A
CVE-2024-0204	Authentication bypass in Fortra’s GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.	9.8 Critical, CWE-425	9.8 Critical, CWE-287	none
CVE-2024-0149	NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an attacker unauthorized access to files. A successful exploit of this vulnerability might lead to limited information disclosure.	3.3 Low, CWE-125	3.3 Low, CWE-200	none

Appendix

Table 12: Test CVEs discussed in Section 4 , with the NVD labels and the output of the fine-tuned model. The last column lists the vector components the model got wrong.

System	Critical	High	Medium	Low
TF-IDF ridge regression (direct)	1.23	0.80	0.96	2.91
TF-IDF + LR, formula	0.59	0.81	1.04	3.26
Phi-3.5 + LoRA, formula	0.53	0.76	0.92	2.90

Appendix

Table 13: Mean absolute score error by true severity tier on the 2024 test set.

	Shortest quartile		Second		Third		Longest quartile
System	Sev.	Vector	Sev.	Vector	Sev.	Vector	Sev.	Vector
TF-IDF + LR, formula	59.7	38.8	67.2	38.4	71.0	50.7	70.6	48.7
Phi-3.5 + LoRA, formula	61.7	42.0	69.7	42.0	74.4	55.7	73.9	55.5

Appendix

Table 14: Severity accuracy and exact-vector rate (%) by quartile of description length on the 2024 test set. Quartile boundaries are 194, 285, and 444 characters.

Tier	NVD	Zero-shot, written	Zero-shot, from vector
Critical	266 (13.3)	1,247 (62.4)	68 (3.4)
High	742 (37.1)	697 (34.8)	558 (27.9)
Medium	951 (47.5)	9 (0.4)	1,146 (57.3)
Low	41 (2.1)	2 (0.1)	15 (0.8)
No valid tier	–	45 (2.2)	–

Appendix

Table 15: Severity tiers on the 2,000-CVE zero-shot sample: as assigned by NIST, as written by zero-shot Phi-3.5, and as computed from the vector it wrote. Counts with shares (%) in parentheses.

Step	Severity acc.	Macro-F1	CWE acc.	Score MAE	Exact vector
1,000	68.2	50.8	65.4	0.83	52.9
2,000	72.6	56.9	67.2	0.73	55.4
3,000	74.4	58.5	71.1	0.66	62.2
4,000	76.0	62.1	73.4	0.65	63.0
5,000	76.3	58.6	74.2	0.63	63.9

Appendix

Table 16: Validation metrics of the fine-tuned model under formula scoring at each saved checkpoint, on the same 1,000 validation CVEs.

Step	Time
All TF-IDF baselines, tuning and test (CPU)	9 min
LoRA fine-tuning, 5,000 steps	2.5 h
LoRA inference, 36,325 test CVEs	4.9 h

Appendix

Table 17: Wall-clock time on a single machine, with inference run in small batches of at most 32 CVEs and without optimization for speed.

Component	CVE	Description	True	Predicted
Attack vector	CVE-2024-0001	A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor to gain elevated privileges.	N	FT:L LR:L CB:L RF:L
	CVE-2024-0311	A malicious insider can bypass the existing policy of Skyhigh Client Proxy without a valid release code.	L	FT:N LR:N CB:N RF:N
	CVE-2024-0315	Remote file inclusion vulnerability in FireEye Central Management affecting version 9.1.1.956704. This vulnerability allows an attacker to upload a malicious PDF file to the system during the report creation process.	L	FT:N LR:N CB:N RF:N
	CVE-2024-0321	Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.	N	FT:L LR:L CB:L RF:L
Attack complexity	CVE-2024-0056	Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability	H	FT:L LR:L CB:L RF:L
	CVE-2024-0144	NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause a buffer overflow issue by means of a specially crafted JPEG2000 file. A successful exploit of this vulnerability might lead to data tampering.	H	FT:L LR:L CB:L RF:L

Appendix

Table 18: Test CVEs on which all four trained systems predicted the wrong value for the listed component (attack vector, attack complexity, privileges required, and user interaction). Bold marks words in the NVD description that may signal the true value. FT: fine-tuned Phi-3.5, LR: logistic regression, CB: class-balanced logistic regression, RF: random forest, all with formula scoring. Values: N network or none, A adjacent, L local or low, P physical, H high, R required, U unchanged, C changed.

Component	CVE	Description	True	Predicted
Scope	CVE-2024-0056	Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability	C	FT:U LR:U CB:U RF:U
	CVE-2024-0171	Dell PowerEdge Server BIOS contains an TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gain access to otherwise unauthorized resources.	C	FT:U LR:U CB:U RF:U
	CVE-2024-0179	SMM Callout vulnerability within the AmdCpmDisplayFeatureSMM driver could allow locally authenticated attackers to overwrite SMRAM, potentially resulting in arbitrary code execution.	C	FT:U LR:U CB:U RF:U
	CVE-2024-0410	An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict.	C	FT:U LR:U CB:U RF:U
Confidentiality	CVE-2024-0171	Dell PowerEdge Server BIOS contains an TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gain access to otherwise unauthorized resources.	L	FT:H LR:H CB:H RF:H
	CVE-2024-0257	RoboDK v5.5.4 is vulnerable to heap-based buffer overflow while processing a specific project file. The resulting memory corruption may crash the application.	N	FT:H LR:H CB:H RF:H

Appendix

Table 19: Test CVEs on which all four trained systems predicted the wrong value for the listed component (scope and the three impacts). Bold marks words in the NVD description that may signal the true value. FT: fine-tuned Phi-3.5, LR: logistic regression, CB: class-balanced logistic regression, RF: random forest, all with formula scoring. Values: N network or none, A adjacent, L local or low, P physical, H high, R required, U unchanged, C changed.

Component	CVE	Description	True	Predicted
Attack vector	CVE-2024-0092	NVIDIA GPU Driver for Windows and Linux contains a vulnerability where an improper check or improper handling of exception conditions might lead to denial of service.	L	FT:L LR:L CB:P RF:L
	CVE-2024-0100	NVIDIA Triton Inference Server for Linux contains a vulnerability in the tracing API, where a user can corrupt system files. A successful exploit of this vulnerability might lead to denial of service and data tampering.	N	FT:N LR:N CB:L RF:N
	CVE-2024-0144	NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause a buffer overflow issue by means of a specially crafted JPEG2000 file. A successful exploit of this vulnerability might lead to data tampering.	N	FT:L LR:L CB:L RF:N
	CVE-2024-0147	NVIDIA GPU display driver for Windows and Linux contains a vulnerability where referencing memory after it has been freed can lead to denial of service or data tampering.	L	FT:L LR:L CB:P RF:L
Attack complexity	CVE-2024-0057	NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability	L	FT:L LR:L CB:H RF:L
	CVE-2024-0179	SMM Callout vulnerability within the AmdCpmDisplayFeatureSMM driver could allow locally authenticated attackers to overwrite SMRAM, potentially resulting in arbitrary code execution.	L	FT:L LR:L CB:H RF:L

Appendix

Table 20: Test CVEs on which at least one, but not all, of the four trained systems predicted the wrong value for the listed component (attack vector, attack complexity, privileges required, and user interaction). Bold marks words in the NVD description that may signal the true value. FT: fine-tuned Phi-3.5, LR: logistic regression, CB: class-balanced logistic regression, RF: random forest, all with formula scoring. Values: N network or none, A adjacent, L local or low, P physical, H high, R required, U unchanged, C changed.

Component	CVE	Description	True	Predicted
Scope	CVE-2024-0078	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user in a guest can cause a NULL-pointer dereference in the host, which may lead to denial of service.	C	FT:U LR:U CB:C RF:U
	CVE-2024-0315	Remote file inclusion vulnerability in FireEye Central Management affecting version 9.1.1.956704. This vulnerability allows an attacker to upload a malicious PDF file to the system during the report creation process.	U	FT:U LR:U CB:C RF:U
	CVE-2024-0427	The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.4.1 does not properly escape user-controlled input when it is reflected in some of its AJAX actions.	U	FT:C LR:U CB:U RF:U
	CVE-2024-0440	Attacker, with permission to submit a link or submits a link via POST to be collected that is using the file:// protocol can then introspect host files and other relatively stored files.	U	FT:U LR:U CB:C RF:U
Confidentiality	CVE-2024-0008	Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access.	H	FT:H LR:N CB:N RF:H
	CVE-2024-0009	An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credentials to establish a VPN connection from an unauthorized IP address.	L	FT:H LR:N CB:L RF:H

Appendix

Table 21: Test CVEs on which at least one, but not all, of the four trained systems predicted the wrong value for the listed component (scope and the three impacts). Bold marks words in the NVD description that may signal the true value. FT: fine-tuned Phi-3.5, LR: logistic regression, CB: class-balanced logistic regression, RF: random forest, all with formula scoring. Values: N network or none, A adjacent, L local or low, P physical, H high, R required, U unchanged, C changed.

LLMs for Cybersecurity

Large language models for cybersecurity support threat analysis, vulnerability research, security operations, and cyber defense.

See all 258 papers

Fine-tuning RoBERTa for CVE-to-CWE Classification: A 125M Parameter Model Competitive with LLMs
Mar 16, 2026Nikita MosievskiyClassification Cybersecurity
Independent Researcher
On Predicting Vulnerability Severity Using In-Context Learning: An Industrial Case Study
Aug 22, 2026Daniel Rodriguez-Cardenas, David Nader Palacio, Anna Schmedding +8Software Security LLMs for Cybersecurity
William & Mary Williamsburg, VA, USA · Microsoft Seattle, WA, USA · Cisco Systems San Jose, CA, USA
Multi-Class vs. Multi-Label BERT for CVE-to-CWE Mapping: How Taxonomy Structure Shapes the Errors
Jul 8, 2026Ana Schwengber Kelm, Christian Bockermann, Jörg FrochteHierarchical Classification Multi-Label Classification
mindsquare AG · Bochum University of Applied Sciences

Mar 16, 2026J/K move · Enter open · S save

Fine-tuning RoBERTa for CVE-to-CWE Classification: A 125M Parameter Model Competitive with LLMs

Nikita Mosievskiy

Independent Researcher

Classification Cybersecurity Software Vulnerability Detection

Open paper AskPDF arXiv

We present a fine-tuned RoBERTa-base classifier (125M parameters) for mapping Common Vulnerabilities and Exposures (CVE) descriptions to Common Weakness Enumeration (CWE) categories. We construct a large-scale training dataset of 234,770 CVE descriptions with AI-refined CWE labels using Claude Sonnet 4.6, and agreement-filtered evaluation sets where NVD and AI labels agree. On our held-out test set (27,780 samples, 205 CWE classes), the model achieves 87.4% top-1 accuracy and 60.7% Macro F1 -- a +15.5 percentage-point Macro F1 gain over a TF-IDF baseline that already reaches 84.9% top-1, demonstrating the model's advantage on rare weakness categories. On the external CTI-Bench benchmark (NeurIPS 2024), the model achieves 75.6% strict accuracy (95% CI: 72.8-78.2%) -- statistically indistinguishable from Cisco Foundation-Sec-8B-Reasoning (75.3%, 8B parameters) at 64x fewer parameters. We release the dataset, model, and training code.

Abstract

LLMs for Cybersecurity

Explore similar work

Fine-tuning RoBERTa for CVE-to-CWE Classification: A 125M Parameter Model Competitive with LLMs

On Predicting Vulnerability Severity Using In-Context Learning: An Industrial Case Study

Multi-Class vs. Multi-Label BERT for CVE-to-CWE Mapping: How Taxonomy Structure Shapes the Errors