CVE-2017-20286

7.8High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.8High

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-787

Impact

Attackers can achieve arbitrary code execution or crash the application by getting a user or service to process a maliciously crafted GIF. This requires the target system to load the untrusted image file.

Root cause

The iGetPalette() function in il_gif.cpp fails to properly bound writes when processing multi-frame GIFs with local colour tables, overflowing the 768-byte palette buffer on the heap by up to 384 bytes.

Affected systems

DevIL through 1.8.0

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Fix & remediation

No official fixed release is listed in the advisory; patch the iGetPalette() function in il_gif.cpp from source or stop processing untrusted GIF files with DevIL.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il_gif.cpp that allows attackers to write beyond a 768-byte palette buffer when loading GIF images. Attackers can supply a crafted two-frame GIF whose second frame uses disposal method 1 with a local colour table, writing up to 384 controlled bytes past the heap allocation and possibly executing code.

References

Source: nvd.nist.gov/vuln/detail/CVE-2017-20286