CVE-2026-23519

HIGH EPSS 38.9%
Published Jan 15, 20265mo ago · Modified Jun 17, 20262w ago
8.9 CVSS 4.0
High
Find Similar
Published Jan 15, 2026 5mo ago
Last Modified Jun 17, 2026 2w ago

Description

RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. Prior to 0.4.4, the thumbv6m-none-eabi (Cortex M0, M0+ and M1) compiler emits non-constant time assembly when using cmovnz (portable version). This vulnerability is fixed in 0.4.4.

CVSS Details

Base Score
8.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
38.9% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-203
CWE-208

Affected Products 1

VendorProductVersionRange
rustcryptocmov* <0.4.4

References 2

  • github.com https://github.com/RustCrypto/utils/commit/55977257e7c82a309d5e8abfdd380a774f0f9778
    Patch
  • github.com https://github.com/RustCrypto/utils/security/advisories/GHSA-2gqc-6j2q-83qp
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/RustCrypto/utils/commit/55977257e7c82a309d5e8abfdd380a774f0f9778
    Patch