CVE-2026-90596

Received Received - Intake

Integer Overflow in embedded-graphics 32-bit Component

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description

A weakness has been identified in embedded-graphics up to 0.8.2 on 32-bit. Impacted is the function ImageRaw::new/bytes_per_row of the file src/image/image_raw.rs. This manipulation causes integer overflow. The attack is possible to be carried out remotely. Upgrading the affected component is recommended. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-13

Last Modified

2026-09-13

Generated

2026-09-14

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-90596

EUVD

EUVD-2026-77126

Affected Vendors & Products

Vendor	Product	Version / Range
embedded-graphics	embedded-graphics	to 0.8.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-189

Attack-Flow Graph

Executive Summary

This vulnerability is an integer overflow in the embedded-graphics library up to version 0.8.2 on 32-bit systems. It occurs in the ImageRaw::new/bytes_per_row function due to improper handling of data, allowing remote attackers to manipulate the system.

Detection Guidance

This vulnerability is specific to the embedded-graphics library version 0.8.2 or earlier on 32-bit systems. Detection involves checking the installed version of the library. Use commands like 'cargo list --package embedded-graphics' in Rust projects or inspect dependency files (Cargo.toml) for versions <= 0.8.2.

Impact Analysis

The vulnerability could allow remote attackers to execute arbitrary code or cause a denial of service by exploiting the integer overflow. This may lead to system crashes or unauthorized access if the affected component is used in a network-facing application.

Compliance Impact

The vulnerability involves an integer overflow in embedded-graphics, which could lead to memory corruption or unexpected behavior. This may impact compliance with GDPR or HIPAA if the affected software processes personal or health data, potentially violating integrity or availability requirements.

Mitigation Strategies

Upgrade the embedded-graphics component to a version beyond 0.8.2 to address the integer overflow issue in the ImageRaw::new/bytes_per_row function.

Hi! I’m here to help you understand CVE-2026-90596. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70