PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8695 Potrace Project CVE debrief

CVE-2016-8695 is a denial-of-service issue in Potrace’s BMP parsing path. A crafted BMP image can trigger a NULL pointer dereference in bm_readbody_bmp in bitmap_io.c, which can crash the process. NVD records this as affecting Potrace versions through 1.12, with a fix in 1.13.

Vendor
Potrace Project
Product
Potrace
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-31
Original CVE updated
2026-05-13
Advisory published
2017-01-31
Advisory updated
2026-05-13

Who should care

Organizations and developers that use Potrace 1.12 or earlier, especially in workflows that accept untrusted BMP images or run image conversion in user-facing services.

Technical summary

The flaw is a NULL pointer dereference (CWE-476) in bm_readbody_bmp within bitmap_io.c. NVD’s CVSS 3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, reflecting a crash/availability impact when a crafted BMP is processed. The CVE description says the input is a crafted BMP image and notes this is distinct from CVE-2016-8694 and CVE-2016-8696.

Defensive priority

Medium. The impact is availability-only, but it affects parsing of attacker-supplied image content and can cause immediate crashes in exposed conversion workflows.

Recommended defensive actions

  • Upgrade Potrace to version 1.13 or later.
  • Inventory systems that ship or embed Potrace 1.12 or earlier.
  • Treat BMP files from untrusted sources as risky input and process them in a sandboxed or isolated service where possible.
  • Add crash monitoring around image-conversion jobs so malformed inputs are easier to detect and triage.

Evidence notes

The NVD record identifies the weakness as CWE-476 and lists the affected CPE range as Potrace through version 1.12, with no later vulnerable range specified. The CVSS 3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. Reference material in the record points to the Potrace ChangeLog, oss-security advisories, a Gentoo blog analysis, and a SecurityFocus entry.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-8695 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-8695

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-8695 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-8695

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.