CVE-2026-90596

MediumCVSS 6.5

Published: 13/09/2026(UTC)Updated: 15/09/2026(UTC)Translated: 14/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

A weakness has been identified in embedded-graphics up to 0.8.2 on 32-bit. Impacted is the function ImageRaw::new/bytes_per_row of the file src/image/image_raw.rs. This manipulation causes integer overflow. The attack is possible to be carried out remotely. Upgrading the affected component is recommended.

Risk Assessment

Integer overflow may lead to unpredictable behavior, crashes, or potential code execution, exposing the system to attacks.

Recommendation

Upgrade the embedded-graphics library to a version later than 0.8.2 once a fix is available.

Other vulnerabilities in embedded-graphics

CVE-2026-90593High
A vulnerability was determined in embedded-graphics up to 0.8.2. This affects the function ImageRaw::draw_sub_image of the file src/image/image_raw.rs. Executing a manipulation of the argument width can lead to integer overflow. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS