PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8700 Potrace Project CVE debrief

CVE-2016-8700 is a high-severity memory corruption issue in potrace’s BMP parsing path. The vulnerability is a heap-based buffer overflow in bm_readbody_bmp within bitmap_io.c, affecting potrace versions before 1.13. The CVE description says a crafted BMP image can trigger the flaw; NVD also classifies the issue as CWE-119 and assigns a CVSS 3.0 score of 7.8 (HIGH).

Vendor
Potrace Project
Product
Potrace
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-31
Original CVE updated
2026-05-13
Advisory published
2017-01-31
Advisory updated
2026-05-13

Who should care

Anyone operating or packaging potrace 1.12 or earlier, especially systems that process untrusted BMP images. Downstream distributors and application maintainers that bundle potrace should also verify they are not shipping a vulnerable build.

Technical summary

The vulnerable function is bm_readbody_bmp in bitmap_io.c, where parsing a crafted BMP can lead to a heap-based buffer overflow. NVD maps the issue to CWE-119 and lists affected potrace versions up to and including 1.12. The record also shows a CVSS 3.0 vector of AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, so the practical exposure should be understood in light of user interaction and local execution context, even though the CVE description refers to a remote attacker and crafted image input.

Defensive priority

High

Recommended defensive actions

  • Upgrade potrace to version 1.13 or later.
  • Inventory all direct and bundled uses of potrace 1.12 and earlier.
  • Treat BMP files from untrusted sources as dangerous input until affected systems are updated.
  • If immediate upgrading is not possible, restrict where potrace can be used and reduce exposure to untrusted image content.
  • Check downstream packages and appliances for backported fixes or lingering vulnerable versions.

Evidence notes

Primary evidence comes from the NVD CVE record and its cited references. The NVD data lists the vulnerability as a heap-based buffer overflow in bm_readbody_bmp in bitmap_io.c, affects potrace versions through 1.12, and maps it to CWE-119. The source references include the potrace ChangeLog, oss-security posts from 2016-08-18 and 2016-10-16, a SecurityFocus entry, and a Gentoo advisory blog post. The CVE record was published on 2017-01-31 and later modified on 2026-05-13. The record contains a notable wording mismatch: the prose description says remote attackers may trigger the issue with a crafted BMP image, while the CVSS vector indicates AV:L and UI:R.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-8700 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-8700

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-8700 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-8700

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.