CVE-2026-50185
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the RustCrypto CMOV library versions 0.1.1 through 0.5.4, the aarch64 implementations of Cmov and CmovEq assume high bits are zero-extended when loading values smaller than a register, which can lead to incorrect results of the cmovz operation.
Risk Assessment
The risk is potential incorrect behavior of conditional move operations, which could affect the correctness of constant-time cryptographic operations, potentially enabling side-channel attacks.
Recommendation
It is recommended to update the RustCrypto CMOV library to version 0.5.4 or later, which contains the fix.
Original NVD description (English source)
RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, the aarch64 implementations of Cmov and CmovEq in cmov/src/backends/aarch64.rs assume high bits are zero-extended when loading values smaller than a register, so set high bits such as [8..] in a Cmov selector or [16..] of self or other in the u16 and i16 CmovEq implementations can cause left.cmovz(&right, condition) to produce incorrect output. This issue is fixed in version 0.5.4.