Integer Overflow Vulnerability in Embedded Graphics Library for 32-bit Systems
CVE-2026-90596

6.9MEDIUM

Key Information:

Vendor

Embedded Graphics

Status
Embedded-graphics
Vendor
CVE Published:
13 September 2026

What is CVE-2026-90596?

A vulnerability has been discovered in the embedded-graphics library prior to version 0.8.2, specifically affecting 32-bit systems. This flaw resides in the ImageRaw::new/bytes_per_row function, allowing for an integer overflow that can potentially be exploited by remote attackers. As a result, it is crucial for users to upgrade to the latest version to safeguard their systems. Despite being alerted to this issue via an issue report, the project maintainers have yet to provide a response.

Affected Version(s)

embedded-graphics 0.8.0

embedded-graphics 0.8.1

embedded-graphics 0.8.2

References

https://vuldb.com/vuln/403178
vdb-entrytechnical-description
https://vuldb.com/vuln/403178/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-90596
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Default01 (VulDB User)
VulDB CNA Team
.