I have not finished reading the paper but after the second sentence in the abstract it seems that the authors clearly define what they consider to be a bug:

I have not finished reading the paper but after the second sentence in the abstract it seems that the authors clearly define what they consider to be a bug: Every bug reported by MAYHEM is accompanied by a working shell-spawning exploit. The working exploits ensure soundness and that each bug report is security critical and actionable.