common strengths and weaknesses of symbolic execution

Strengths:

• when a test case fails, the program is proven to be incorrect;
• automatic test cases catch errors that are often overlooked in manual written test cases (this is from KLEE paper);
• it can be used for reverse-engineering and also be used for software verification purposes;

Weaknesses:

• when no tests fail we are not sure everything is correct, because no proof of correctness is given; static analysis can do that when it works (and often it does not!);
• covering all the paths is not enough, because a variable can hold different values in one path and only some of them cause a bug;
• complete coverage for non trivial programs is often impossible, due to path explosion or constraint solver timeout;
• scaling is difficult, and execution time of the engine can suffer;
• undefined behavior of CPU could lead to unexpected results;
• … and maybe there are a lot more remarks to add.