The DevIL image library (version 1.8.0 and earlier) contains a heap-based buffer overflow in the iGetPalette() routine used to process GIF files. The overflow occurs when loading GIF images that include a second frame with disposal method 1 and a local colour table. The library allocates only a 768‑byte palette buffer but can write up to 384 bytes past this allocation, enabling an attacker to place arbitrary data and potentially execute malicious code.

Affected systems are any installations that use DevIL libraries prior to 1.8.1, specifically the DevIL community edition through version 1.8.0. Applications that embed DevIL for GIF loading, such as image editors, game engines, or web servers that decode user‑supplied GIFs, are within scope. No specific customer products are listed beyond the generic DevIL library.

The severity of the flaw is high with a CVSS score of 8.5. No EPSS information is available and it is not catalogued in the CISA KEV list. Attackers can exploit it by supplying a specially crafted GIF file to any application that loads GIF images through DevIL; the overflow may lead to code execution or denial of service. Because the heap buffer is overwritten directly, exploitation does not require administrative privileges, but the attacker must have the ability to supply a malicious GIF to the target application.