Skip to content
CVE PROGRAM SOURCE RECORD8.9 High

CVE-2026-23519

RustCrypto cmov: thumbv6m-none-eabi compiler emits non-constant time assembly when using cmovnz

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. Prior to 0.4.4, the thumbv6m-none-eabi (Cortex M0, M0+ and M1) compiler emits non-constant time assembly when using cmovnz (portable version). This vulnerability is fixed in 0.4.4.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

RustCrypto utils

  • < 0.4.4affected

References