PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8686 Potrace Project CVE debrief

CVE-2016-8686 is a high-severity flaw in potrace's bm_new path that can be triggered by a crafted image and lead to memory allocation failure. The source corpus describes unspecified impact, while NVD assigns a CVSS 3.0 score of 7.8 with high confidentiality, integrity, and availability impact ratings. Treat this as a risk for workflows that process attacker-controlled images with vulnerable potrace builds, and verify the exact affected version range because the corpus contains a version mismatch.

Vendor
Potrace Project
Product
Potrace
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-31
Original CVE updated
2026-05-13
Advisory published
2017-01-31
Advisory updated
2026-05-13

Who should care

Administrators, package maintainers, and developers who run potrace on user-supplied or otherwise untrusted images, especially in automated conversion pipelines, document-processing services, or desktop applications that invoke potrace behind the scenes.

Technical summary

The vulnerability is described in the bm_new function in bitmap.h in potrace. According to the source corpus, a crafted image can trigger a memory allocation failure. NVD maps the weakness to CWE-119 and rates the issue CVSS 3.0 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The corpus also contains a source inconsistency: the narrative description mentions potrace 1.13, while the NVD CPE criteria marks versions up to 1.12 as vulnerable.

Defensive priority

High for any environment that accepts untrusted images and may invoke potrace; otherwise moderate if the input set is tightly controlled.

Recommended defensive actions

  • Check whether any installed or bundled potrace version matches the vulnerable range in your vendor's package metadata.
  • Update to a non-vulnerable potrace release or apply the vendor's backport if available.
  • Review pipelines that convert user-supplied images and limit where potrace is used on untrusted content.
  • Add monitoring and inventory checks for embedded or transitive potrace usage in applications and build systems.
  • If you cannot upgrade immediately, reduce exposure by restricting who can submit files and by isolating image-conversion jobs.

Evidence notes

Primary evidence comes from the NVD record and its linked advisories. The NVD description states that bm_new in bitmap.h in potrace can be driven by a crafted image into a memory allocation failure. NVD assigns CVSS 3.0 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and CWE-119. The reference set in the corpus includes an Openwall oss-security mailing-list post, a SecurityFocus BID entry, and a Gentoo advisory. The corpus contains a notable inconsistency: the narrative description names potrace 1.13, but the NVD CPE criteria marks versions through 1.12 as vulnerable. The NVD record was published on 2017-01-31 and later modified on 2026-05-13.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-8686 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-8686

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-8686 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-8686

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.