Nuwa: a next-generation fuzzer for modern Windows application security

What the paper says

Purpose The purpose of this paper is to introduce Nuwa, a robust fuzzing framework for testing real-world Windows applications (UWP, WinUI2, WinUI3 and Win32), addressing challenges like multi-process architectures and complex graphical user interfaces (GUIs) that hinder existing tools. Design/methodology/approach Nuwa integrates: a lightweight instrumentation module using WinDbg C++ API for code coverage; a scheduling algorithm prioritizing inputs based on coverage feedback; and an automated interaction layer leveraging Windows automation APIs for GUI manipulation with malformed inputs. The instrumentation module provides real-time coverage feedback, which is used by the scheduling algorithm to prioritize inputs that are more likely to trigger new code paths. The automated interaction module ensures that these inputs can be delivered to the application, even when complex GUI interactions are required. Findings Testing on Siemens Solid Edge Free Viewer and Windows Media Player (UWP) revealed critical vulnerabilities, including out-of-bound writes, reads and zero day. Siemens yielded 9 CVEs (CVE-2023–39181 to CVE-2023–39186, CVE-2024–47941, CVE-2024–47940 and CVE-2024–54091), while Media Player had 3 undisclosed zero day (2 AVI, 1 MOV parsing), impacting millions of devices and causing Windows Explorer crashes. Experiments show Nuwa also outperforms WinAFL in both DynamoRIO and Intel-PT modes in metrics including compatibility, fuzzing throughput and coverage. Originality/value To the best of the authors’ knowledge, Nuwa is the first coverage-guided fuzzing framework for real-world Windows apps, combining efficient instrumentation, smart scheduling and automated GUI interaction to fill a critical gap in fuzzing tools.