Vulnerability detection is an important activity in industrial software engineering. This is due to high security and safety demands in domains like automotive or aerospace. We observe that many machine-learning based approaches for vulnerability detection have been proposed in the last years, but that most of them only consider individual functions. However, our experience in automotive software shows that more context is required to judge about potential vulnerabilities.

This work introduces InterGNN, a graph-based model designed for vulnerability identification that leverages interprocedural information from real-world C/C++ programs. The approach constructs Code Property Graphs containing data- and control-flow relationships and uses a GNN architecture to generate node-level code embeddings. We combine that model with a label propagation mechanism that highlights vulnerable execution paths across function calls. We evaluate InterGNN on a public dataset (InterPVD) and one industry-grade dataset of embedded C code (AooB). Our experiments demonstrate that InterGNN matches state-of-the-art performance and outperforms competitive baselines, such as ReVeal, by up to 6.9% points in F1 score when interprocedural context is involved.

While these gains are promising, especially in large real-world code bases, safety-relevant systems still prioritize high recall, often guaranteed by the application of Static Application Security Testing tools. In this context, InterGNN is not meant to operate in isolation but to complement such recall-oriented analyses by improving precision and thus reducing the manual review effort in industrial vulnerability detection pipelines. These results highlight the practicality of InterGNN for real-world vulnerability detection.