CVE-2016-8702: Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows rem...

Security readout for executives and security teams

CVE-2016-8702 is a heap-based buffer overflow in Potrace's BMP reader before 1.13. A crafted BMP image could trigger memory corruption with unspecified impact. Business urgency depends on whether Potrace processes user-supplied or externally sourced BMP files in your workflows. Exposure is likely where Potrace is installed directly, bundled in conversion pipelines, or invoked by web services, batch jobs, or desktop tools handling untrusted BMP images. The bundle does not identify downstream products or packages. Prioritize if Potrace handles user-uploaded or partner-supplied BMP files, especially in internet-facing conversion workflows. If Potrace is absent or only processes trusted local files, urgency is lower. Because impact details are incomplete, treat remediation as exposure-driven rather than score-driven. Mitigation focus: Upgrade Potrace to version 1.13 or later where feasible.; Check operating system and package maintainer guidance for backported fixes.; Restrict Potrace processing of untrusted BMP files until fixed..

Prepared

Jun 13, 2026, 06:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.