See how devil compares to other vendors in security performance
DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in ilgif.cpp that allows attackers to write beyond a 768-byte palette buffer when loading GIF images. Attackers can supply a crafted two-frame GIF whose second frame uses disposal method 1 with a local colour table, writing up to 384 controlled bytes past the heap allocation and possibly executing code.
Multiple stack-based buffer overflows in the iGetHdrHeader function in src-IL/src/ilhdr.c in DevIL 1.7.4 allow context-dependent attackers to execute arbitrary code via a crafted Radiance RGBE file.