CVE-2026-90593

embedded-graphics image_raw.rs draw_sub_image integer overflow

View on CVE.org
Published Sep 13, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was determined in embedded-graphics up to 0.8.2. This affects the function ImageRaw::draw_sub_image of the file src/image/image_raw.rs. Executing a manipulation of the argument width can lead to integer overflow. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

Analysis

AI-generated

Technical impact

The flaw is an integer overflow caused by manipulating the width argument in the draw_sub_image function of the embedded-graphics Rust library. The overflow can corrupt internal calculations of buffer sizes or memory offsets, potentially leading to memory corruption, crashes, or, if the code runs with elevated privileges, to privilege escalation. The weakness is represented by CWE‑189 and CWE‑190.

Affected Systems

The embedded‑graphics Rust library, versions 0.8.0 through 0.8.2, are affected. This library is commonly used in embedded devices to render pixel data on displays. Any system that incorporates one of these versions and processes externally supplied images could be impacted.

Risk and Exploitability

The CVSS score is 6.9, indicating moderate severity. The EPSS score is less than 1%, implying a very low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote: an attacker can supply a crafted image to the application that uses the library and manipulate the width parameter to trigger the overflow.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade embedded-graphics to a fixed version or apply the developer’s patch.
  • Validate image dimensions and reject requests where the width exceeds the actual image bounds.
  • Limit access to image rendering functions to trusted input or sandbox the rendering process.

Generated by OpenCVE AI on September 15, 2026 at 17:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was determined in embedded-graphics up to 0.8.2. This affects the function ImageRaw::draw_sub_image of the file src/image/image_raw.rs. Executing a manipulation of the argument width can lead to integer overflow. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
Title embedded-graphics image_raw.rs draw_sub_image integer overflow
First Time appeared Embedded-graphics
Embedded-graphics embedded-graphics
Weaknesses CWE-189
CWE-190
CPEs cpe:2.3:a:embedded-graphics:embedded-graphics:*:*:*:*:*:*:*:*
Vendors & Products Embedded-graphics
Embedded-graphics embedded-graphics
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 16, 2026, 2:15 PM
Reserved
Sep 12, 2026, 6:18 PM

View source JSON

Updated
Sep 16, 2026, 2:15 PM

JSON

Status
Deferred
Published
Sep 13, 2026, 9:17 PM
Modified
Sep 16, 2026, 3:18 PM

View source JSON

No data.

Updated
Sep 27, 2026, 9:00 AM

JSON