CVE-2026-90596 Details
Description
A weakness has been identified in embedded-graphics up to 0.8.2 on 32-bit. Impacted is the function ImageRaw::new/bytes_per_row of the file src/image/image_raw.rs. This manipulation causes integer overflow. The attack is possible to be carried out remotely. Upgrading the affected component is recommended. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability exists in the embedded-graphics library versions prior to 0.8.2 on 32-bit platforms. The issue arises in the ImageRaw::new function, specifically within the bytes_per_row calculation, where an integer overflow occurs. This overflow can be exploited remotely, allowing empty data to be validated as correct image data, which could lead to improper rendering on displays, particularly in safety-critical applications.
Users are advised to upgrade to embedded-graphics version 0.8.2 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 13, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/embedded-graphics/embedded-graphics/issues/820 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/embedded-graphics/embedded-graphics/ | [email protected] | ProductSource CodeVendor |
| https://github.com/embedded-graphics/embedded-graphics/issues/820 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-90596 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/913790 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/403178 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/403178/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-189 | Numeric Errors | [email protected] |
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| embedded-graphics | <= 0.8.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 13, 2026 | New CVE Received | [email protected] |