CVE-2026-50185 Details
Description
RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, the aarch64 implementations of Cmov and CmovEq in cmov/src/backends/aarch64.rs assume high bits are zero-extended when loading values smaller than a register, so set high bits such as [8..] in a Cmov selector or [16..] of self or other in the u16 and i16 CmovEq implementations can cause left.cmovz(&right, condition) to produce incorrect output. This issue is fixed in version 0.5.4.
A vulnerability exists in the RustCrypto CMOV implementation for Aarch64 processors, specifically in versions 0.1.1 prior to 0.5.4. The issue arises because the Aarch64 CMOV and CMOVEQ functions incorrectly assume that high bits are zero-extended when loading values smaller than the register size. This misassumption can lead to incorrect behavior, such as failing to properly conditionally move values between registers. The problem is particularly evident in the CMOVEQ implementations for 16-bit integers.
Users should upgrade to RustCrypto CMOV version 0.5.4 or later, where this issue has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/RustCrypto/utils/security/advisories/GHSA-3rjw-m598-pq24 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/RustCrypto/utils/commit/dba6c355c9f241e3726d5ec2a68f9f3b519f6063 | [email protected] | Patch |
| https://github.com/RustCrypto/utils/releases/tag/cmov-v0.5.4 | [email protected] | Product |
| https://github.com/RustCrypto/utils/security/advisories/GHSA-3rjw-m598-pq24 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-758 | Reliance on Undefined, Unspecified, or Implementation-Defined Behavior | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rustcrypto cmov | >= 0.1.1, < 0.5.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 18, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |