CVE-2026-90593: embedded-graphics RCE Vulnerability

CVE-2026-90593 Overview

CVE-2026-90593 is an integer overflow vulnerability in the embedded-graphics Rust crate through version 0.8.2. The flaw resides in the ImageRaw::draw_sub_image function within src/image/image_raw.rs. An attacker who can influence the width argument passed to this function can trigger an integer overflow during size calculations. The issue was reported to the project through a public GitHub issue, but the maintainers have not yet responded. Because embedded-graphics is widely used in embedded and IoT Rust projects for rendering images to displays, applications that expose image parameters to remote or untrusted input are exposed to this weakness. The vulnerability is categorized under [CWE-189] (Numeric Errors).

Critical Impact
A remote attacker supplying a crafted width argument to ImageRaw::draw_sub_image can trigger an integer overflow, leading to incorrect memory calculations and downstream memory safety or availability issues.

Affected Products

embedded-graphics crate versions up to and including 0.8.2
Rust applications and firmware that call ImageRaw::draw_sub_image with attacker-influenced parameters
Embedded and IoT devices using vulnerable versions of the crate for display rendering

Discovery Timeline

2026-09-13 - CVE-2026-90593 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90593

Vulnerability Analysis

The vulnerability affects ImageRaw::draw_sub_image in src/image/image_raw.rs within the embedded-graphics crate. The function performs arithmetic on the width argument to calculate image regions and buffer offsets. When a caller supplies a large width value, the internal multiplication or addition wraps past the maximum integer bound, producing an undersized or otherwise incorrect result. Downstream logic then uses this incorrect value to index pixel buffers or size drawing regions. In debug builds the overflow may panic; in release builds Rust performs wrapping arithmetic by default, allowing the corrupted value to propagate silently. The attack is reachable remotely when the width parameter originates from network-supplied image metadata, configuration, or user-supplied assets.

Root Cause

The root cause is the absence of checked arithmetic on the width argument prior to using it in sub-image geometry calculations. The function does not validate that width-derived offsets remain within valid buffer bounds, nor does it use checked_mul or saturating_mul when computing sub-image extents.

Attack Vector

An attacker delivers a crafted image or configuration whose width parameter is processed by an application that calls ImageRaw::draw_sub_image. The overflow produces an incorrect region size, which can lead to out-of-bounds memory access, rendering corruption, or a denial-of-service condition depending on how the caller handles the resulting slice.

No verified public exploit code is available. See the GitHub Issue #821 and VulDB CVE-2026-90593 entry for additional technical details.

Detection Methods for CVE-2026-90593

Indicators of Compromise

Unexpected panics or aborts originating in embedded-graphics image rendering paths on affected devices
Rendering artifacts, corrupted display output, or process crashes correlated with processing externally supplied images
Application logs showing arithmetic overflow errors or slice indexing panics in image_raw.rs

Detection Strategies

Perform software composition analysis (SCA) against Cargo.lock files to identify projects depending on embedded-graphics version 0.8.2 or earlier.
Run cargo audit in CI pipelines to flag advisories against the embedded-graphics crate once the ecosystem advisory is published.
Review call sites of ImageRaw::draw_sub_image and ImageRaw::new to identify code paths that accept externally controlled dimensions.

Monitoring Recommendations

Monitor embedded application crash telemetry for panics originating in the embedded-graphics image module.
Track dependency bills of materials (SBOMs) for firmware images to detect the vulnerable crate version across deployed fleets.
Alert on repeated deserialization failures or malformed image inputs on network-facing services that render images.

How to Mitigate CVE-2026-90593

Immediate Actions Required

Inventory all Rust projects and firmware that depend on embedded-graphics and identify versions at or below 0.8.2.
Constrain externally controlled width, height, and offset values before passing them to ImageRaw::draw_sub_image.
Add validation that rejects images whose dimensions exceed the target display or backing buffer size.
Track the GitHub Issue #821 for an upstream fix.

Patch Information

At the time of publication, the embedded-graphics maintainers have not released a fixed version. The reporter states that the project was notified through an issue report but has not responded. Monitor the embedded-graphics GitHub repository for a patched release and update Cargo.toml constraints once a fixed version is available.

Workarounds

Wrap calls to ImageRaw::draw_sub_image with input validation that enforces maximum width and height bounds appropriate for the target display.
Use checked_mul when computing image byte sizes from width and height before invoking the vulnerable function.
Reject or sanitize image assets from untrusted network sources at the application boundary rather than relying on the crate to validate dimensions.
Consider forking the crate and applying local patches that use checked arithmetic until an upstream fix is available.

bash

# Identify vulnerable dependency versions across Rust projects
cargo tree -i embedded-graphics
cargo audit

# Pin to a patched version once released (example placeholder)
# In Cargo.toml:
# embedded-graphics = ">=0.8.3"