Executive brief
embedded-graphics is a graphics library used in embedded applications and microcontrollers. A flaw in version 0.8.2 and earlier on 32-bit platforms allows attackers to bypass image validation by triggering an integer overflow, which could result in blank or corrupted display output in safety-critical systems like medical devices, automotive displays, or industrial controls.
Technical details
The vulnerability is an integer overflow (CWE-190) in the bytes_per_row function of src/image/image_raw.rs. On 32-bit platforms where usize equals u32, multiplying width and bits_per_pixel values that produce exactly 2^32 causes the multiplication to wrap to zero, setting both bytes_per_row and expected_size to 0. This allows an empty data slice to pass the ImageRaw::new validation, bypassing security checks. An attacker can remotely provide crafted width and bits_per_pixel values (e.g., width=2147483648 with 2bpp) to trigger the overflow. The vulnerability is specific to 32-bit ARM targets (Cortex-M, RISC-V RV32) and does not affect 64-bit systems. No patch has been released as of the advisory date.
Affected products
- embedded-graphics embedded-graphics up to 0.8.2
Timeline
- 2026-08-03: disclosed: Issue #820 reported on GitHub
- 2026-09-13: advisory: CVE-2026-90596 published