PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8701 Potrace Project CVE debrief

CVE-2016-8701 is a memory-corruption flaw in Potrace's BMP parser. A crafted BMP image can trigger a heap-based buffer overflow in bm_readbody_bmp within bitmap_io.c. NVD rates the issue HIGH and maps affected versions through 1.12, with the fix associated with the 1.13 release line.

Vendor
Potrace Project
Product
Potrace
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-31
Original CVE updated
2026-05-13
Advisory published
2017-01-31
Advisory updated
2026-05-13

Who should care

Administrators, developers, and security teams responsible for software that uses Potrace to process BMP files should care most, especially if those images can come from untrusted sources. Package maintainers should also verify whether downstream builds have the fix backported.

Technical summary

The vulnerability is a heap-based buffer overflow in bm_readbody_bmp in bitmap_io.c, tracked as CWE-119. The NVD record marks Potrace versions up to and including 1.12 as affected and indicates that upgrading to 1.13 or later is the relevant remediation boundary. The CVSS 3.0 vector is 7.8 HIGH (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so user interaction is required for the vulnerable code path to be reached.

Defensive priority

High. Prioritize remediation on any system or application that processes untrusted BMP input with Potrace 1.12 or earlier, or that bundles Potrace as a dependency.

Recommended defensive actions

  • Upgrade Potrace to version 1.13 or a vendor package that clearly includes the fix.
  • Inventory applications, libraries, and pipelines that invoke Potrace for BMP processing and confirm their bundled version.
  • Treat BMP files from untrusted sources as potentially dangerous and limit where they are opened or processed.
  • Use sandboxing, least privilege, and process isolation for any image-conversion workflow that depends on Potrace.
  • Verify downstream distributions or vendor packages for backported fixes if a direct upgrade is not immediately possible.

Evidence notes

The supplied NVD record describes a heap-based buffer overflow in bm_readbody_bmp in bitmap_io.c, identifies CWE-119, and lists affected versions through 1.12. The reference set includes the upstream Potrace ChangeLog, two oss-security mailing-list posts from 2016, a SecurityFocus entry, and a Gentoo advisory-style blog post dated 2016-08-08, indicating that the issue was discussed before the NVD publication date of 2017-01-31.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-8701 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-8701

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-8701 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-8701

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.