A modern car is a network of computers: sensors, electronic control units, the infotainment system, the telematics unit. A flaw in any of them can put the vehicle, its owner, or the data it holds at risk, and those flaws get catalogued publicly in the CVE database.

The catalogue entries are prose. Someone writes a paragraph describing what went wrong. A security team needs something else entirely: structured facts about which asset is affected, what class of weakness it is, and how an attacker would behave. Turning thousands of paragraphs into that structure by hand is exactly the sort of work that never quite gets done.

This paper evaluates whether open-weight language models can do the conversion. The choice of open-weight is not incidental, because vulnerability analysis is sensitive work and many organisations would rather not send their threat picture to somebody else's API.