Integer Overflow Vulnerability in embedded-graphics by embedded-graphics

CVE-2026-90593

What is CVE-2026-90593?

The embedded-graphics library, specifically in the ImageRaw::draw_sub_image function of src/image/image_raw.rs, contains a critical vulnerability that allows for integer overflow by manipulating the argument width. This flaw enables attackers to exploit the vulnerability remotely, potentially leading to unauthorized access or execution of malicious code. Despite the vulnerability being reported through an issue, the maintainers have not yet addressed the problem, leaving systems utilizing the affected versions exposed to risks.

References