CVE-2026-90596: embedded-graphics image_raw.rs new/bytes_per_row integer overflow
A weakness has been identified in embedded-graphics up to 0.8.2 on 32-bit. Impacted is the function ImageRaw::new/bytesperrow of the file src/image/imageraw.rs. This manipulation causes integer overflow. The attack is possible to be carried out remotely. Upgrading the affected component is recommended. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects embedded-graphics versions up to 0.8.2 when used on 32-bit systems. The provided information does not establish impact on 64-bit systems.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network attack access, low attack complexity, no privileges required, and no user interaction.
What is the impact of a successful exploit?
The reported impact is limited to integrity and availability, with no confidentiality impact indicated. The affected ImageRaw::new and bytes_per_row functionality can be manipulated to cause an integer overflow.
What should teams do if they use the affected component?
Upgrade the affected embedded-graphics component, as recommended in the advisory. If an upgrade is not immediately possible, the provided data does not identify a workaround or mitigation.