Back to overview

CVE-2026-50185

LOW
2.0
CVSS 4.0
Description
RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, the aarch64 implementations of Cmov and CmovEq in cmov/src/backends/aarch64.rs assume high bits are zero-extended when loading values smaller than a register, so set high bits such as [8..] in a Cmov selector or [16..] of self or other in the u16 and i16 CmovEq implementations can cause left.cmovz(&right, condition) to produce incorrect output. This issue is fixed in version 0.5.4.

Metadata

CVE ID
CVE-2026-50185
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-06-03 22:05 UTC
Published
2026-07-17 18:35 UTC
Last updated
2026-07-17 18:35 UTC
Primary CWE
CWE-758
CWE-758: Reliance on Undefined, Unspecified, or Implementati…
Vendor / Product
RustCrypto / utils
Sources
cve.org  ·  NVD

Severity & Metrics

2.0 LOW CVSS 4.0
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products (1)
VendorProductPlatformVersions
RustCrypto utils — >= 0.1.1, < 0.5.4
Weakness (CWE)
CWESourceDescription
CWE-758 cna CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
CVSS scores (1)
ScoreSeverityVersionSourceVector
2.0 LOW 4.0 cna CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References (3)
Back to overview