PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8702 Potrace Project CVE debrief

CVE-2016-8702 is a heap-based buffer overflow in Potrace’s BMP parser, bm_readbody_bmp() in bitmap_io.c. The issue affects Potrace versions before 1.13, with the vulnerable version range in NVD ending at 1.12. A crafted BMP image can trigger the flaw, and NVD rates the issue HIGH with potential impact to confidentiality, integrity, and availability.

Vendor
Potrace Project
Product
Potrace
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-31
Original CVE updated
2026-05-13
Advisory published
2017-01-31
Advisory updated
2026-05-13

Who should care

Administrators, developers, and product teams using Potrace before 1.13, especially in workflows that accept or convert untrusted BMP files.

Technical summary

NVD classifies this as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The vulnerable code path is bm_readbody_bmp() in bitmap_io.c. The NVD CVSS vector is CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and the affected CPE range is Potrace through version 1.12. The record references vendor and third-party advisories, including the Potrace ChangeLog and OSS security mailing list posts.

Defensive priority

High for any environment that processes BMP files from untrusted or semi-trusted sources; otherwise medium but still worth scheduling promptly because the flaw is memory-corruption in a file parser.

Recommended defensive actions

  • Upgrade Potrace to version 1.13 or later.
  • Inventory applications and services that embed or invoke Potrace and confirm which version they ship.
  • Treat BMP files from untrusted sources as hostile input and restrict where they are accepted.
  • Run file-processing components with least privilege and, where possible, in a sandbox or isolated service.
  • Watch for crashes or abnormal behavior in any BMP conversion or tracing workflows until patched.
  • If an upgrade is not immediately possible, backport the vendor fix from the 1.13 release line if your distribution supports it.

Evidence notes

The supplied NVD record shows CVE-2016-8702 published on 2017-01-31 and modified on 2026-05-13. It identifies a heap-based buffer overflow in bm_readbody_bmp() in bitmap_io.c, assigns CWE-119, and lists Potrace versions through 1.12 as vulnerable. References in the record include the Potrace ChangeLog, OSS-security mailing list advisories, a SecurityFocus entry, and a Gentoo security note.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-8702 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-8702

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-8702 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-8702

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.