A critical integer overflow vulnerability in the embedded-graphics library allows remote attackers to trigger memory errors, potentially impacting system stability.

This vulnerability is an integer overflow (CWE-190) located in the ImageRaw::draw_sub_image function within src/image/image_raw.rs, which can be exploited by an unauthenticated remote attacker.

Successful exploitation of this integer overflow can lead to unexpected program behavior or memory corruption, potentially resulting in a denial of service for embedded systems relying on this library. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to devices that process untrusted image data, as it may cause system crashes or instability in critical operational environments.

Immediate Action: As no official patch is currently available, users should monitor the official project repository for a fix and avoid processing untrusted image data using the affected versions of embedded-graphics.

Proactive Monitoring: Implement input validation routines to sanitize image width parameters before they are passed to the draw_sub_image function to prevent overflow conditions.

Compensating Controls: Deploy strict boundary checks in the application code surrounding image rendering logic to ensure that provided dimensions do not exceed expected memory limits.

Public Exploit Available: Unknown.

Given the high CVSS score and the current lack of a vendor-provided patch, organizations utilizing embedded-graphics should prioritize code-level mitigations and restrict the input sources that feed into the vulnerable draw_sub_image function. Transitioning to a secure version or implementing robust manual input validation is essential to maintaining the integrity and availability of affected systems until an upstream fix is released.