Abstract:The tainted-based directed fuzzing is an important technology to find bugs towards several given suspicious vulnerable code areas in black-box scenarios. It sets program's input as initial taints, uses dynamic taint tracing to locate the regions of input related to suspicious code areas. Then it only fuzzes the located input, thus avoids a large part of testing unrelated to the suspicious areas. But the existing researches haven't analyzed its real world challenges systematically and haven't evaluated its performance enhancement mathematically. To solve this problem, this paper uses 14 CVEs as benchmark to do its limitation analysis, abstracts the fuzzing as shifted geometric distribution to get performance enhancement equation and analyzes the performance variation trend. Analyses show that the tainted-based directed fuzzing has limitations on fuzzing bugs containing metadata relation in the taint propagation. And the experiments verify that the performance enhancement equation has a good reference value.