CVE-2026-90596: embedded-graphics Integer Overflow RCE

CVE-2026-90596 Overview

CVE-2026-90596 is an integer overflow vulnerability in the embedded-graphics Rust crate through version 0.8.2 on 32-bit platforms. The flaw resides in the ImageRaw::new function and its bytes_per_row calculation in src/image/image_raw.rs. An attacker can trigger the overflow remotely by supplying crafted image dimensions to code that consumes untrusted input through the library. The maintainers were notified through the project issue tracker but had not responded at the time of publication.

Critical Impact
Remote attackers can trigger an integer overflow in bytes_per_row, producing incorrect buffer size calculations that can lead to out-of-bounds memory access or denial of service on 32-bit embedded targets.

Affected Products

embedded-graphics crate versions up to and including 0.8.2
32-bit target architectures (usize width of 32 bits)
Downstream firmware and embedded applications that consume image data from untrusted sources

Discovery Timeline

2026-09-13 - CVE-2026-90596 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90596

Vulnerability Analysis

The vulnerability is classified under [CWE-189] (Numeric Errors) and stems from an unchecked arithmetic operation inside ImageRaw::new. When the library computes bytes_per_row from user-supplied width and bits-per-pixel values, the multiplication can exceed the maximum value of a 32-bit usize. The wrapped result understates the true row size, causing downstream code to allocate or index buffers using an incorrect length. This class of numeric error is a common precursor to out-of-bounds reads, out-of-bounds writes, and panics in Rust binaries built without overflow checks in release mode.

Root Cause

The root cause is arithmetic on usize values without saturating or checked multiplication when computing the number of bytes required to hold a pixel row. On 32-bit targets, a width and pixel-depth combination that produces a product greater than u32::MAX silently wraps. The returned ImageRaw then reports a truncated bytes_per_row, breaking the invariant that the buffer length matches the declared image geometry.

Attack Vector

An attacker who controls image parameters processed by ImageRaw::new can pass width and format values crafted to overflow the multiplication. Because embedded-graphics is often used in firmware that renders network-sourced images, telemetry frames, or user-supplied assets, the input path may be reachable over the network. Successful exploitation results in mismatched buffer sizing that subsequent drawing operations will read from or write past. On constrained 32-bit MCUs, this typically manifests as a panic, hard fault, or corrupted framebuffer memory.

No public proof-of-concept exploit code is available. See the GitHub Issue Tracker and the VulDB entry for CVE-2026-90596 for reported details.

Detection Methods for CVE-2026-90596

Indicators of Compromise

Unexpected panics, hard faults, or watchdog resets on 32-bit embedded devices immediately after image-processing routines execute.
Corrupted framebuffer output, misaligned rendering, or partial image draws following ingestion of externally sourced image data.
Crash logs referencing image_raw.rs, ImageRaw::new, or bytes_per_row in stack traces.

Detection Strategies

Perform a software bill of materials (SBOM) review across firmware builds to identify use of embedded-graphics at or below version 0.8.2.
Add unit and fuzz tests that pass boundary width, height, and pixel-depth combinations to ImageRaw::new and assert absence of overflow.
Enable overflow-checks = true in the release profile of Cargo builds targeting 32-bit hardware to convert silent wraps into observable panics during testing.

Monitoring Recommendations

Monitor device telemetry for abnormal reboot rates or fault counters correlated with rendering workloads.
Capture and centralize firmware crash dumps to a log analytics backend to surface repeated failures inside image-decoding code paths.
Track upstream advisories on the embedded-graphics GitHub repository for release of a fixed version.

How to Mitigate CVE-2026-90596

Immediate Actions Required

Inventory all firmware and Rust projects that depend on embedded-graphics and flag any pinned to 0.8.2 or earlier, particularly those targeting 32-bit MCUs.
Restrict or validate image width, height, and pixel-format inputs before they reach ImageRaw::new, rejecting values whose product exceeds a safe threshold.
Rebuild release firmware with overflow-checks = true where the performance cost is acceptable, so overflows produce panics rather than silent memory corruption.

Patch Information

No vendor patch was available at the time of publication. The maintainers were informed through the project issue tracker but have not responded. Monitor the embedded-graphics issue #820 and the VulDB record for CVE-2026-90596 for a fixed release, then upgrade to the first version that addresses the overflow in bytes_per_row.

Workarounds

Wrap calls to ImageRaw::new with a caller-side check that computes width * bytes_per_pixel using usize::checked_mul and rejects any input that returns None.
Constrain accepted image dimensions to values that cannot overflow a 32-bit usize for the maximum supported pixel depth in the application.
Isolate image parsing behind a privilege or process boundary where feasible, so a fault in rendering does not compromise the wider device state.

bash

# Configuration example: enable overflow checks in release builds
# Add to Cargo.toml of the top-level firmware crate
[profile.release]
overflow-checks = true