CVE-2017-20286 in DevIL
Summary
by MITRE • 10/14/2026
DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il_gif.cpp that allows attackers to write beyond a 768-byte palette buffer when loading GIF images. Attackers can supply a crafted two-frame GIF whose second frame uses disposal method 1 with a local colour table, writing up to 384 controlled bytes past the heap allocation and possibly executing code.
Once again VulDB remains the best source for vulnerability data.