CVE-2026-90596: embedded-graphics image_raw.rs new/bytes_per_row integer overflow

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-13 · updated 2026-09-15
Weakness: CWE-189

Description

A weakness has been identified in embedded-graphics up to 0.8.2 on 32-bit. Impacted is the function ImageRaw::new/bytes_per_row of the file src/image/image_raw.rs. This manipulation causes integer overflow. The attack is possible to be carried out remotely. Upgrading the affected component is recommended. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

embedded-graphics: 0.8.0, 0.8.1, 0.8.2

References

https://github.com/embedded-graphics/embedded-graphics/
https://github.com/embedded-graphics/embedded-graphics/issues/820
https://vuldb.com/cve/CVE-2026-90596
https://vuldb.com/submit/913790
https://vuldb.com/vuln/403178
https://vuldb.com/vuln/403178/cti
https://github.com/embedded-graphics/embedded-graphics/issues/820

Get alerted when CVE-2026-90596 or the next vulnerability affects your stack