Coverage

A metric measuring which branches, edges, or lines of code were executed during a fuzzing campaign.

In the context of fuzzing, coverage measures how much of the target program's code has been exercised by the current corpus. Edge (branch) coverage is the standard metric for coverage-guided fuzzers: it counts the number of unique source-edge-destination-edge pairs (branch transitions) that have been observed across all executions. Line coverage and basic-block coverage are coarser and can miss control-flow distinctions. Coverage serves two purposes in fuzzing: as the feedback signal the fuzzer uses to select and retain corpus entries, and as the progress metric a human uses to evaluate when a fuzzing campaign has likely exhausted accessible code paths. Coverage plateauing — the number of new edges discovered per day flattening out — is the primary indicator that a campaign has reached diminishing returns and that structural improvements (better seeds, dictionaries, or additional fuzzers) are needed.