CVE-2026-50185

Katalog CVE

CVSS 3.3 · Low EPSS 0,16%

Kerentanan Reliance on Undefined, Unspecified, or Implementation-Defined Behavior pada rustcrypto cmov. Skor CVSS 3.1 3.3 (Low) menurut NVD.

Deskripsi (NVD)

RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, the aarch64 implementations of Cmov and CmovEq in cmov/src/backends/aarch64.rs assume high bits are zero-extended when loading values smaller than a register, so set high bits such as [8..] in a Cmov selector or [16..] of self or other in the u16 and i16 CmovEq implementations can cause left.cmovz(&right, condition) to produce incorrect output. This issue is fixed in version 0.5.4.

Rincian

Terbit di NVD

17 Juli 2026

Terakhir diubah

18 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

3.3 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/RustCrypto/utils/security/advisories/GHSA-3rjw-m598-pq24 exploit · advisory vendor
• https://github.com/RustCrypto/utils/commit/dba6c355c9f241e3726d5ec2a68f9f3b519f6063 patch
• https://github.com/RustCrypto/utils/releases/tag/cmov-v0.5.4 product