Description

A weakness has been identified in embedded-graphics up to 0.8.2 on 32-bit. Impacted is the function ImageRaw::new/bytes_per_row of the file src/image/image_raw.rs. This manipulation causes integer overflow. The attack is possible to be carried out remotely. Upgrading the affected component is recommended. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-13T22:17:00.577Z",
  "pubdate": "2026-09-13T22:17:00.577Z",
  "executiveSummary": "A critical integer overflow vulnerability has been identified in the embedded-graphics crate, specifically affecting versions up to and including 0.8.2 when deployed on 32-bit architectures.\nThe vulnerability resides within the image handling logic of the library, specifically concerning the calculation of byte offsets and memory allocation requirements.\nBy manipulating input parameters processed by the ImageRaw::new and bytes_per_row functions, a remote attacker can trigger an integer overflow.\nThis flaw can lead to memory corruption, potentially causing application crashes (Denial of Service) or facilitating arbitrary memory access if the overflow is leveraged to bypass bounds checks in downstream operations.\nThe vulnerability is particularly concerning in embedded environments where memory safety and robust error handling are critical for system stability.\nAs the project maintainers have not yet responded to the reported issue, users of the library are currently exposed and must exercise caution when processing untrusted image data.\nThere are no authentication or specific privilege requirements for exploitation, as the vulnerability is inherent to the way the library handles image metadata parsing.",
  "technicalDetails": "The vulnerability originates in src/image/image_raw.rs within the ImageRaw::new constructor and the bytes_per_row helper function. On 32-bit platforms, these functions perform arithmetic operations to calculate the total size or row stride of an image raw buffer without adequate checks for arithmetic overflow.\nThe root cause is an unchecked integer operation where user-supplied image dimensions (width and height) or stride values are multiplied. When these values are sufficiently large, the resulting product exceeds the maximum value representable by a 32-bit unsigned integer (u32::MAX), causing the value to wrap around.\nThe exploitation flow begins when an application utilizes embedded-graphics to parse image data provided by an untrusted remote source. The attacker constructs a malicious image header or metadata packet that specifies dimensions designed to trigger the overflow during the initialization of the ImageRaw object.\nOnce the overflow occurs, the bytes_per_row function returns a truncated value that no longer accurately reflects the memory requirements for the image buffer. This discrepancy leads to an under-allocation of memory or an incorrect pointer calculation when the library attempts to iterate over or access the image pixels.\nWhen the application later attempts to read from or write to the image buffer based on the corrupted stride calculation, it may perform an out-of-bounds memory access. In many embedded contexts, this results in a kernel panic or hard fault, effectively triggering a Denial of Service condition.\nFurthermore, if the application logic relies on the returned bytes_per_row to perform bounds checking or memory copying, the overflow can be leveraged to bypass these protections, potentially enabling the reading of sensitive memory areas or the overwriting of adjacent heap objects if the library is used in a context where such memory layout is predictable.\nSince the vulnerability exists at the library level, any 32-bit embedded system processing images via these functions is theoretically susceptible. The impact is significant as embedded-graphics is widely used in resource-constrained environments where memory safety mechanisms like ASLR or hardware-backed MMUs may be absent or limited, making exploitation more deterministic."
}