CVE-2026-23519
Medium · 6.8RustCrypto Utilities cmov: `thumbv6m-none-eabi` compiler emits non-constant time assembly when using `cmovnz`
CVSS
6.8
EPSS
0.6%
Published
Jan 15, 2026
CISA due date
—
The record
`thumbv6m-none-eabi` (Cortex M0, M0+ and M1) compiler emits non-constant time assembly when using `cmovnz` (portable version). I did not found any other target with the same behaviour but I did not go through all targets supported by Rust.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | cmov | 0 | 0.4.4 |
| crates.io | cmov | 0.0.0-0 | 0.4.4 |
| Chainguard | yazi | 0 | 26.1.4-r2 |
| Wolfi | yazi | 0 | 26.1.4-r2 |
Related vulnerabilities
- RUSTSEC-2026-0003 Non-constant-time code generation on ARM32 targets Same vulnerability
- CVE-2026-25727 time provides date and time handling in Rust. Also affects yazi
- CVE-2026-25541 Bytes is a utility library for working with bytes. Also affects yazi
- CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows… CWE-208
- CVE-2026-49265 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. CWE-208
- CVE-2026-77696 Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret… CWE-208
- CVE-2026-54875 Issue summary: A non-constant-time optimized implementation of scalar point… CWE-208
- CVE-2026-54872 Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2… CWE-208