PatchSiren cyber security CVE debrief
CVE-2016-8699 Potrace Project CVE debrief
CVE-2016-8699 is a heap-based buffer overflow in Potrace's BMP parsing path, specifically bm_readbody_bmp in bitmap_io.c. The issue affects Potrace versions before 1.13, and the CVE description says a crafted BMP image can trigger impact on the target. The NVD record classifies it as CWE-119 and rates it 7.8 HIGH.
- Vendor
- Potrace Project
- Product
- CVE-2016-8699
- CVSS
- HIGH 7.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2017-01-31
- Original CVE updated
- 2026-05-13
- Advisory published
- 2017-01-31
- Advisory updated
- 2026-05-13
Who should care
Administrators, package maintainers, and application owners using Potrace 1.12 or earlier—especially wherever untrusted BMP files are processed or converted.
Technical summary
The vulnerable code path is bm_readbody_bmp in bitmap_io.c, where malformed BMP input can overflow heap memory (CWE-119). NVD marks versions through 1.12 as vulnerable and assigns CVSS 3.0 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The record notes this CVE is distinct from related Potrace BMP issues CVE-2016-8698 and CVE-2016-8700 through CVE-2016-8703.
Defensive priority
High — prioritize upgrading Potrace deployments that may handle untrusted BMP files.
Recommended defensive actions
- Upgrade Potrace to version 1.13 or later.
- Inventory systems and downstream packages that bundle or depend on Potrace 1.12 or earlier.
- Restrict or sandbox BMP processing for untrusted input until patched.
- Treat externally sourced BMP files as high risk and validate them before handing them to Potrace.
- Review crash reports and memory-corruption signals in any Potrace-based workflow.
Evidence notes
The NVD record identifies Potrace versions through 1.12 as vulnerable, names bm_readbody_bmp in bitmap_io.c, and maps the issue to CWE-119. The supplied references include a Potrace ChangeLog entry, August and October 2016 oss-security posts, a Gentoo advisory blog post, and a SecurityFocus BID entry, which together corroborate the disclosure trail.
Official resources
-
CVE-2016-8699 CVE record
CVE.org
-
CVE-2016-8699 NVD detail
NVD
-
Source item URL
nvd_modified
-
Mitigation or vendor reference
[email protected] - Release Notes, Third Party Advisory
-
Mitigation or vendor reference
[email protected] - Mailing List, Third Party Advisory
-
Mitigation or vendor reference
[email protected] - Mailing List, Third Party Advisory
-
Mitigation or vendor reference
[email protected] - Third Party Advisory, VDB Entry
-
Mitigation or vendor reference
[email protected] - Third Party Advisory
The issue was publicly discussed in third-party advisories in August and October 2016, and the CVE record was published on 2017-01-31. The NVD record was later modified on 2026-05-13, which is metadata update timing and not the original bug