How severe is CVE-2026-50185?

CVE-2026-50185 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2026-50185 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-50185?

CVE-2026-50185 affects Rustcrypto Cmov. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-50185?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-50185 published?

CVE-2026-50185 was published on 2026-07-17 and last updated on 2026-08-18.

CVE-2026-50185

CVE-2026-50185 is a low-severity vulnerability in Rustcrypto Cmov with a CVSS 3.x base score of 3.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-758.

Key facts

Severity: Low (CVSS 3.x base score 3.3)
CVSS v4: 2.0
EPSS exploit prediction: 0% (5th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-758
Affected product: Rustcrypto Cmov
Published: 2026-07-17
Last modified: 2026-08-18

Description

RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, the aarch64 implementations of Cmov and CmovEq in cmov/src/backends/aarch64.rs assume high bits are zero-extended when loading values smaller than a register, so set high bits such as [8..] in a Cmov selector or [16..] of self or other in the u16 and i16 CmovEq implementations can cause left.cmovz(&right, condition) to produce incorrect output. This issue is fixed in version 0.5.4.

Frequently asked questions

What is CVE-2026-50185?: RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, the aarch64 implementations of Cmov and CmovEq in cmov/src/backends/aarch64.rs assume high bits are zero-extended when loading values smaller than a register, so set high bits such as [8..] in a Cmov selector or [16..] of self or other in the u16 and i16 CmovEq implementations can cause left.cmovz(&right, condition) to produce incorrect output. This issue is fixed in version 0.5.4.
How severe is CVE-2026-50185?: CVE-2026-50185 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2026-50185 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-50185?: CVE-2026-50185 affects Rustcrypto Cmov. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-50185?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-50185 published?: CVE-2026-50185 was published on 2026-07-17 and last updated on 2026-08-18.

References

Affected products (1)

cpe:2.3:a:rustcrypto:cmov:*:*:*:*:*:rust:*:*

More vulnerabilities in Rustcrypto Cmov

CVE-2026-23519 — Critical (CVSS 9.8): RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in…

All CVEs affecting Rustcrypto Cmov →

Other CWE-758 vulnerabilities

CVE-2026-4705 — Critical (CVSS 9.8): Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9,…
CVE-2026-16441 — Critical (CVSS 9.6): In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has…
CVE-2026-4724 — Critical (CVSS 9.1): Undefined behavior in the Audio/Video component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
CVE-2026-4718 — High (CVSS 8.1): Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9,…
CVE-2025-54811 — High (CVSS 7.1): OpenPLC_V3 has a vulnerability in the enipThread function that occurs due to the lack of a return value. This leads to…
CVE-2024-4774 — Medium (CVSS 6.5): The `ShmemCharMapHashEntry()` code was susceptible to potentially undefined behavior by bypassing the move semantics…

Browse all CWE-758 vulnerabilities →