CVE-2026-90593: embedded-graphics image_raw.rs draw_sub_image integer overflow
Published Sep 13, 2026
·Updated
A vulnerability was determined in embedded-graphics up to 0.8.2. This affects the function ImageRaw::drawsubimage of the file src/image/imageraw.rs. Executing a manipulation of the argument width can lead to integer overflow. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
1 affected component
embedded-graphics<=0.8.2
Event History
Sep 13, 2026
CVE Published
via MITRE·08:30 PM
Data Sourced
via MITRE·08:30 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require authentication or user interaction?
The supplied vector indicates no privileges and no user interaction are required. The issue is described as remotely launchable when an attacker can manipulate the width argument.
2
How can I determine whether my application is affected?
Check whether it uses embedded-graphics version 0.8.2 or earlier and invokes ImageRaw::draw_sub_image. The vulnerable condition is associated with attacker-controlled manipulation of the width argument.