Description

A vulnerability was determined in embedded-graphics up to 0.8.2. This affects the function ImageRaw::draw_sub_image of the file src/image/image_raw.rs. Executing a manipulation of the argument width can lead to integer overflow. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-13T21:17:02.787Z",
  "pubdate": "2026-09-13T21:17:02.787Z",
  "executiveSummary": "The embedded-graphics library up to version 0.8.2 contains an integer overflow vulnerability within the ImageRaw::draw_sub_image function located in src/image/image_raw.rs.\nThis vulnerability is triggered through the manipulation of the 'width' argument during the sub-image rendering process.\nAn attacker can exploit this flaw by providing crafted inputs that cause an arithmetic overflow, potentially leading to memory corruption or undefined behavior within the embedded environment.\nThe vulnerability is remotely exploitable, posing a significant risk to systems utilizing this library for image processing.\nAs the maintainers have not yet addressed the issue despite early notification, affected systems remain exposed to potential exploitation if they process untrusted or malformed image data.",
  "technicalDetails": "The vulnerability resides in the ImageRaw::draw_sub_image function within src/image/image_raw.rs, specifically concerning how the 'width' parameter is handled during calculation.\nThe root cause is an unchecked arithmetic operation where the provided 'width' argument is utilized in size or offset calculations without prior validation or saturation arithmetic, leading to an integer overflow.\nIn the context of embedded-graphics, an integer overflow occurs when the result of a calculation exceeds the storage capacity of the integer type used. When this value is subsequently used to determine memory offsets or buffer sizes for drawing operations, it can result in out-of-bounds memory access.\nThe attack flow begins with an attacker providing a malicious 'width' value that, when processed by the function, causes the internal calculation to wrap around. This effectively tricks the memory allocation or pointer arithmetic logic into referencing a memory location outside the intended bounds of the image buffer.\nExploitation requires the attacker to have the ability to influence the input parameters passed to the draw_sub_image function. Because this is a library-level vulnerability, it affects any application using embedded-graphics that allows external input to define image dimensions.\nIf the underlying system does not provide robust memory protection, such as those often found in bare-metal embedded environments, this overflow can lead to critical memory corruption, potentially causing arbitrary read/write primitives or system crashes (Denial of Service).\nThe lack of bounds checking or the use of standard arithmetic operators instead of checked arithmetic (e.g., checked_add, checked_mul) allows the overflow to go undetected by the Rust compiler's runtime checks in release mode, depending on configuration and environment.\nThe impact is elevated by the fact that the vulnerability is remotely exploitable, provided the application accepts externally supplied image metadata. Post-exploitation impact could range from system instability to the corruption of adjacent memory structures, potentially impacting the functional safety of the embedded device."
}