Cyber Resilience

CVE-2026-23519

Rustcrypto Cmov ≤ 0.4.4

Public PoC
Published
15 January 2026
Modified
23 January 2026
Patch / advisory
CVSS Score v4 8.9
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0050 40th percentile
Risk Priority 36 floored blend · peak EPSS

Summary

CVE-2026-23519 is a high-severity Observable Timing Discrepancy (CWE-208) vulnerability in Rustcrypto Cmov. Its CVSS base score is 8.9 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Password Guessing (T1110.001); ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to IA-6 (Authentication Feedback) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-23519 is a timing side-channel vulnerability in the RustCrypto CMOV crate, part of the RustCrypto/utils repository. The crate provides conditional move CPU intrinsics intended to execute in constant time on major platforms without compiler rewriting to branches. In versions prior to 0.4.4, when targeting thumbv6m-none-eabi (Cortex-M0, M0+, and M1 architectures), the compiler emits non-constant-time assembly for the portable cmovnz implementation. This violates the constant-time guarantee, mapped to CWE-208 (Observable Discrepancy) and CWE-203 (Observable Behavior), with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Remote attackers require no privileges, authentication, or user interaction to exploit this over a network with low complexity. Exploitation involves observing timing differences in cmovnz operations, potentially allowing recovery of sensitive data such as cryptographic keys during operations relying on the crate for constant-time conditional moves. The high impact on confidentiality, integrity, and availability stems from the side-channel leakage enabling broader compromise of affected embedded systems using these targets.

The GitHub security advisory (GHSA-2gqc-6j2q-83qp) and commit 55977257e7c82a309d5e8abfdd380a774f0f9778 detail the fix in version 0.4.4, which addresses the compiler-emitted assembly issue for thumbv6m-none-eabi targets. Security practitioners should update to RustCrypto/utils 0.4.4 or later and audit dependencies using vulnerable versions in Cortex-M0/M0+/M1 firmware.

EU & UK References

Vulnerability Data

RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. Prior to 0.4.4, the thumbv6m-none-eabi (Cortex M0, M0+ and M1) compiler emits non-constant time…

more

assembly when using cmovnz (portable version). This vulnerability is fixed in 0.4.4.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1110.001 Password Guessing Credential Access
Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.
T1087 Account Discovery Discovery
Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment.
T1087.001 Local Account Discovery
Adversaries may attempt to get a listing of local system accounts.
T1087.002 Domain Account Discovery
Adversaries may attempt to get a listing of domain accounts.
T1087.003 Email Account Discovery
Adversaries may attempt to get a listing of email addresses and accounts.
T1087.004 Cloud Account Discovery
Adversaries may attempt to get a listing of cloud accounts.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-49092Same vendor: Rustcrypto
CVE-2023-40021Shared CWE-203, CWE-208
CVE-2023-25806Shared CWE-203, CWE-208
CVE-2023-1538Shared CWE-203, CWE-208
CVE-2026-45410Shared CWE-203, CWE-208
CVE-2024-56738Shared CWE-203, CWE-208
CVE-2026-23849Shared CWE-203, CWE-208
CVE-2023-32694Shared CWE-203, CWE-208
CVE-2024-21671Shared CWE-203, CWE-208
CVE-2025-30344Shared CWE-203, CWE-208

Affected Assets

rustcrypto
cmov
≤ 0.4.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)
  • V11.2.4

Mitigating Controls (NIST 800-53 r5) AI

Obscures authentication feedback so that success/failure differences are not observable to attackers.

Developer testing can include timing analysis or side-channel test cases that reveal observable timing discrepancies.

Requires error messages to avoid revealing exploitable details, directly stopping observable response discrepancies.

Engineering principles can mandate constant-time algorithms and side-channel resistance so timing discrepancies are never introduced.

Requiring approved cryptographic modules and algorithms implicitly demands implementations free of observable timing leaks.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require constant-time implementations that eliminate observable timing discrepancies.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

none

Consistent reference clocks limit the attacker's ability to measure or manipulate timing differences that could reveal internal state or processing paths.

References