PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8694 Potrace Project CVE debrief

CVE-2016-8694 describes a denial-of-service flaw in Potrace’s BMP parser. A crafted BMP image can trigger a NULL pointer dereference in bm_readbody_bmp in bitmap_io.c, crashing the process. The NVD record ties the affected range to Potrace 1.12 and earlier, with the fix implied by the 1.13 boundary.

Vendor
Potrace Project
Product
Potrace
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-31
Original CVE updated
2026-05-13
Advisory published
2017-01-31
Advisory updated
2026-05-13

Who should care

Maintainers and operators of software that uses Potrace to process untrusted BMP images, especially deployments still on Potrace 1.12 or earlier.

Technical summary

NVD identifies CWE-476 (NULL Pointer Dereference) in bm_readbody_bmp within bitmap_io.c. The vulnerability is described as a crash/denial of service triggered by crafted BMP input. NVD’s CVSS 3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating availability impact with user interaction required. The narrative in the CVE description says remote attackers can trigger the issue, while the CVSS vector models the attack as local with user interaction; that scope detail should be reviewed in context of the affected deployment.

Defensive priority

Medium

Recommended defensive actions

  • Upgrade Potrace to 1.13 or later, or otherwise remove versions 1.12 and earlier from service.
  • Inventory applications and pipelines that decode BMP files through Potrace and confirm whether they process untrusted input.
  • Isolate or sandbox image-conversion jobs that must handle external BMP files.
  • Treat crashes in bitmap parsing paths as a signal to test for vulnerable Potrace versions and replace or patch them promptly.

Evidence notes

The supplied NVD record states: Potrace before 1.13 is vulnerable; bm_readbody_bmp in bitmap_io.c can be reached by a crafted BMP image and can cause a NULL pointer dereference and crash. The CPE range marks Potrace 1.12 and earlier as vulnerable. NVD assigns CWE-476 and CVSS 3.0 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. References in the corpus include the Potrace ChangeLog, oss-security mailing list posts, a SecurityFocus entry, and a Gentoo blog advisory. The record was published on 2017-01-31 and last modified on 2026-05-13; the modified date is record metadata, not the issue date.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-8694 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-8694

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-8694 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-8694

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.