A vulnerability analyzer comprising: a single route derivation unit configured to derive single route information that maintains each process of program information in order of processing, the single route information being route information from an attack determination position where determination of existence of vulnerability of the program information is made to a start position of the program information, the single route information being information of a route that is derived by being divided by branches in the program information; characterized by a variable analysis unit configured to analyze the single route information from the start position to the attack determination position, extract a branch result and a branch condition information of a branch position, and derive actual value range information that limits a value range of an actual value from the branch condition information and the branch result in the program information; a memory editing unit configured to set, in a case where input variable information is specified by a user, a virtual address within a secured memory space corresponding to the input variable information and an input flag corresponding to the virtual address, stores actual value information of the input variable information to an actual value field of the virtual address, acquires a virtual address corresponding to actual value range information notified from the variable analysis unit, and stores the actual value range information to an actual value range field of the virtual address; and a vulnerability existence determination unit configured to extract variable information used in an attack execution condition at the attack determination position, acquire a virtual address corresponding to the variable information, acquire actual value information and actual value range information corresponding to the virtual address, calculate limited input actual value information in which the acquired actual value information is limited by the actual value range information in a case where an input flag is set to the virtual address and determine whether or not the limited input actual value information satisfies the attack execution condition, and determine, in a case where an input flag is not set to the virtual address, whether or not actual value information corresponding to the virtual address satisfies the attack execution condition. a single route derivation unit configured to derive single route information that maintains each process of program information in order of processing, the single route information being route information from an attack determination position where determination of existence of vulnerability of the program information is made to a start position of the program information, the single route information being information of a route that is derived by being divided by branches in the program information; characterized by a variable analysis unit configured to analyze the single route information from the start position to the attack determination position, extract a branch result and a branch condition information of a branch position, and derive actual value range information that limits a value range of an actual value from the branch condition information and the branch result in the program information; a memory editing unit configured to set, in a case where input variable information is specified by a user, a virtual address within a secured memory space corresponding to the input variable information and an input flag corresponding to the virtual address, stores actual value information of the input variable information to an actual value field of the virtual address, acquires a virtual address corresponding to actual value range information notified from the variable analysis unit, and stores the actual value range information to an actual value range field of the virtual address; and a vulnerability existence determination unit configured to extract variable information used in an attack execution condition at the attack determination position, acquire a virtual address corresponding to the variable information, acquire actual value information and actual value range information corresponding to the virtual address, calculate limited input actual value information in which the acquired actual value information is limited by the actual value range information in a case where an input flag is set to the virtual address and determine whether or not the limited input actual value information satisfies the attack execution condition, and determine, in a case where an input flag is not set to the virtual address, whether or not actual value information corresponding to the virtual address satisfies the attack execution condition.