CVE-2026-90596CWE-190

CVE-2026-90596

Medium · published September 14, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
46.8
In the wild
Unconfirmed
What it is

A weakness has been identified in embedded-graphics up to 0.8.2 on 32-bit. Impacted is the function ImageRaw::new/bytes_per_row of the file src/image/image_raw.rs. This manipulation causes integer overflow. The attack is possible to be carried out remotely. Upgrading the affected component is recommended. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00577 · 46.8th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-09-14T02:17Z
References (7)
https://github.com/embedded-graphics/embedded-graphics/ · [email protected]https://github.com/embedded-graphics/embedded-graphics/issues/820 · [email protected]https://vuldb.com/cve/CVE-2026-90596 · [email protected]https://vuldb.com/submit/913790 · [email protected]https://vuldb.com/vuln/403178 · [email protected]https://vuldb.com/vuln/403178/cti · [email protected]https://github.com/embedded-graphics/embedded-graphics/issues/820 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 15 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 13 SEP 21:15Z
    embedded-graphics image_raw.rs new/bytes_per_row integer overflow
    cvelistv5