PatchSiren cyber security CVE debrief
CVE-2016-8696 Potrace Project CVE debrief
CVE-2016-8696 is a denial-of-service issue in potrace’s BMP parsing path. A crafted BMP image can trigger a NULL pointer dereference in bm_readbody_bmp, causing the application to crash. NVD lists the issue as affecting potrace versions through 1.12, and the CVE description places the fix boundary at before 1.13. This is a stability and availability problem rather than a confidentiality or integrity issue.
- Vendor
- Potrace Project
- Product
- Potrace
- CVSS
- MEDIUM 5.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2017-01-31
- Original CVE updated
- 2026-05-13
- Advisory published
- 2017-01-31
- Advisory updated
- 2026-05-13
Who should care
Security and platform teams that deploy potrace 1.12 or earlier, especially where the tool processes untrusted BMP images as part of automated conversion, document workflows, or user-submitted uploads. Any downstream product bundling potrace should also verify whether it inherited the vulnerable parser code.
Technical summary
The vulnerable code path is bm_readbody_bmp in bitmap_io.c. According to the CVE record, a crafted BMP can lead to a NULL pointer dereference and crash. NVD classifies the weakness as CWE-476 and rates the impact as CVSS 3.0 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The issue is distinct from CVE-2016-8694 and CVE-2016-8695.
Defensive priority
Medium. The bug can be used to crash affected systems that process attacker-controlled BMP files, so it is worth prioritizing wherever untrusted images are accepted. If potrace is not exposed to external input, the operational risk is lower.
Recommended defensive actions
- Upgrade potrace to version 1.13 or later, or apply the vendor fix if you maintain a downstream package.
- Inventory systems and applications that embed potrace or invoke it on user-supplied BMP files.
- Treat BMP inputs as untrusted and add file-validation controls around conversion pipelines.
- If you cannot upgrade immediately, reduce exposure by limiting which users can submit BMP files and by isolating image-processing jobs.
- Monitor for unexpected crashes or repeated failures in workflows that use potrace, as those may indicate attempted triggering or latent compatibility issues.
Evidence notes
Primary evidence comes from the NVD CVE record and MITRE-linked references. The NVD description states that bm_readbody_bmp in bitmap_io.c in potrace before 1.13 allows remote attackers to cause a denial of service via a crafted BMP image. NVD also classifies the weakness as CWE-476 and lists affected versions through 1.12. Supporting references include the potrace ChangeLog and third-party advisories linked from the CVE record.
Sources and references
Verified primary and authoritative sources
-
CVE-2016-8696 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2016-8696
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2016-8696 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2016-8696
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://blogs.gentoo.org/ago/2016/08/08/potrace-multiple-three-null-pointer-dereference-in-bm_readbody_bmp-bitmap_io-c/
[email protected] - Third Party Advisory
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.