PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8699 Potrace Project CVE debrief

CVE-2016-8699 is a heap-based buffer overflow in Potrace's BMP parsing path, specifically bm_readbody_bmp in bitmap_io.c. The issue affects Potrace versions before 1.13, and the CVE description says a crafted BMP image can trigger impact on the target. The NVD record classifies it as CWE-119 and rates it 7.8 HIGH.

Vendor
Potrace Project
Product
Potrace
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-31
Original CVE updated
2026-05-13
Advisory published
2017-01-31
Advisory updated
2026-05-13

Who should care

Administrators, package maintainers, and application owners using Potrace 1.12 or earlier—especially wherever untrusted BMP files are processed or converted.

Technical summary

The vulnerable code path is bm_readbody_bmp in bitmap_io.c, where malformed BMP input can overflow heap memory (CWE-119). NVD marks versions through 1.12 as vulnerable and assigns CVSS 3.0 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The record notes this CVE is distinct from related Potrace BMP issues CVE-2016-8698 and CVE-2016-8700 through CVE-2016-8703.

Defensive priority

High — prioritize upgrading Potrace deployments that may handle untrusted BMP files.

Recommended defensive actions

  • Upgrade Potrace to version 1.13 or later.
  • Inventory systems and downstream packages that bundle or depend on Potrace 1.12 or earlier.
  • Restrict or sandbox BMP processing for untrusted input until patched.
  • Treat externally sourced BMP files as high risk and validate them before handing them to Potrace.
  • Review crash reports and memory-corruption signals in any Potrace-based workflow.

Evidence notes

The NVD record identifies Potrace versions through 1.12 as vulnerable, names bm_readbody_bmp in bitmap_io.c, and maps the issue to CWE-119. The supplied references include a Potrace ChangeLog entry, August and October 2016 oss-security posts, a Gentoo advisory blog post, and a SecurityFocus BID entry, which together corroborate the disclosure trail.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-8699 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-8699

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-8699 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-8699

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.