CVE-2017-20286
DevIL through 1.8.0 Heap Buffer Overflow via GIF iGetPalette
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il_gif.cpp that allows attackers to write beyond a 768-byte palette buffer when loading GIF images. Attackers can supply a crafted two-frame GIF whose second frame uses disposal method 1 with a local colour table, writing up to 384 controlled bytes past the heap allocation and possibly executing code.
| CWE | CWE-787 |
| Vendor | dentonw |
| Product | devil |
| Published | Oct 14, 2026 |
| Last Updated | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for dentonw devil
Be the first to know when new high vulnerabilities affecting dentonw devil are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
DentonW / DevIL
0 ≤ 1.8.0
References
github.com: https://github.com/DentonW/DevIL/issues/67 hackmd.io: https://hackmd.io/@haind-pwn/devil-gif-palette-reuse-heap-overflow github.com: https://github.com/DentonW/DevIL/blob/a2d9193fed0c7f93519c0c4c28b3348e0cb5759b/DevIL/src-IL/src/il_gif.cpp#L189-L226 github.com: https://github.com/DentonW/DevIL/blob/a2d9193fed0c7f93519c0c4c28b3348e0cb5759b/DevIL/src-IL/src/il_gif.cpp#L314-L324 vulncheck.com: https://www.vulncheck.com/advisories/devil-through-1.8.0-heap-buffer-overflow-via-gif-igetpalette
Credits
Photosounder HaiND from the Post and Telecommunication Institute of Technology