DevIL: Heap-based buffer overflow in GIF palette handling
Summary
DevIL through version 1.8.0 contains a heap-based buffer overflow in the GIF loader function iGetPalette(). A crafted two-frame GIF with a local colour table in the second frame can write up to 384 bytes beyond a 768-byte heap buffer. A successful attack may lead to a crash or possibly arbitrary code execution in the context of the application that loads the image.
Affected
- DentonW DevIL, versions 0 up to and including 1.8.0
- Distribution packages based on 1.8.0 are presumed affected but not verified
Fixed in
Unknown. No patched upstream release or vendor advisory is known.
Workaround
- Remove DevIL where no installed application needs it
- Do not process untrusted GIF files with DevIL-based components
- Isolate image processing (sandbox, container or low-privilege service) and restrict inputs to validated formats
Exploitation
- No reports of exploitation in the wild and no CISA KEV listing
- VulDB describes exploitation as easy (its own assessment, not confirmed exploitation)
- EPSS score 0.00199 (low)
- Attack requires a local context and a user or system to process a crafted GIF (UI:P)
Our recommendation
- Check Linux servers and workstations for DevIL (libIL or devil packages) and identify applications that embed it
- Treat any internet-facing service that processes uploaded images with DevIL as high priority
- Apply the isolation and input restriction measures above until a fixed version is available
- Replace DevIL with a maintained decoder in applications you control
- Monitor the upstream project and your distribution's security tracker for a fix
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2017-20286 in OSV (Ubuntu) osv.dev
- Ubuntu CVE-2017-20286 ubuntu.com
- VulDB 419914 vuldb.com
- VulncheckAdvisory www.vulncheck.com
- DevIL issue 67 github.com
- DevIL project on GitHub github.com
- DevIL releases github.com
- Red Hat CVE-2017-20286 (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:37.
Original description (NVD)
DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il_gif.cpp that allows attackers to write beyond a 768-byte palette buffer when loading GIF images. Attackers can supply a crafted two-frame GIF whose second frame uses disposal method 1 with a local colour table, writing up to 384 controlled bytes past the heap allocation and possibly executing code.
NVD references (5)
- https://github.com/DentonW/DevIL/blob/a2d9193fed0c7f93519c0c4c28b3348e0cb5759b/DevIL/src-IL/src/il_gif.cpp#L1…
- https://github.com/DentonW/DevIL/blob/a2d9193fed0c7f93519c0c4c28b3348e0cb5759b/DevIL/src-IL/src/il_gif.cpp#L3…
- https://github.com/DentonW/DevIL/issues/67
- https://hackmd.io/@haind-pwn/devil-gif-palette-reuse-heap-overflow
- https://www.vulncheck.com/advisories/devil-through-1.8.0-heap-buffer-overflow-via-gif-igetpalette
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.