CVE-2026-23519: RustCrypto CMOV Privilege Escalation Flaw

CVE-2026-23519 Overview

CVE-2026-23519 is a timing attack vulnerability discovered in the RustCrypto CMOV library, which provides conditional move CPU intrinsics designed to execute in constant-time across major platforms. The vulnerability affects versions prior to 0.4.4 when compiled for the thumbv6m-none-eabi target architecture (Cortex M0, M0+, and M1 processors). When using the cmovnz portable version on these platforms, the compiler emits non-constant time assembly code, potentially enabling side-channel attacks that could compromise cryptographic operations.

Critical Impact

Cryptographic implementations relying on RustCrypto CMOV for constant-time operations on ARM Cortex M0/M0+/M1 embedded devices may be vulnerable to timing-based side-channel attacks, potentially exposing sensitive cryptographic keys or data.

Affected Products

• RustCrypto CMOV versions prior to 0.4.4
• Applications compiled for thumbv6m-none-eabi target (ARM Cortex M0, M0+, M1)
• Embedded systems using the portable cmovnz implementation

Discovery Timeline

• 2026-01-15 - CVE-2026-23519 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2026-23519

Vulnerability Analysis

This vulnerability is classified as CWE-208 (Observable Timing Discrepancy), a side-channel attack vector that exploits timing variations in cryptographic operations. The RustCrypto CMOV library was specifically designed to provide constant-time conditional move operations—a critical requirement for secure cryptographic implementations that must resist timing analysis.

The core issue lies in how the compiler handles the portable cmovnz (conditional move if not zero) implementation when targeting ARM Cortex M0, M0+, and M1 processors (thumbv6m-none-eabi). Instead of generating true constant-time assembly instructions, the compiler optimizes the code into branching instructions that execute in variable time depending on the input values.

Root Cause

The root cause stems from architectural limitations of the ARMv6-M instruction set used in Cortex M0/M0+/M1 processors. Unlike more advanced ARM architectures that support true conditional execution instructions (IT blocks with full support), the Thumb-1 instruction set in ARMv6-M has restricted conditional execution capabilities. When the RustCrypto CMOV portable implementation is compiled for this target, the compiler cannot generate equivalent constant-time code and instead falls back to branch-based conditional logic.

This creates observable timing differences—branches taken vs. not taken—that an attacker with precise timing measurements can exploit to infer information about secret values being processed.

Attack Vector

The attack vector for this vulnerability is network-accessible, requiring high attack complexity. An attacker would need to:

1. Identify a target system running cryptographic code compiled with the vulnerable CMOV library on Cortex M0/M0+/M1 hardware
2. Perform timing measurements by sending carefully crafted inputs and measuring response times with high precision
3. Collect sufficient timing samples to statistically correlate timing variations with secret key bits
4. Reconstruct sensitive data through differential timing analysis

In embedded IoT environments where Cortex M0/M0+/M1 processors are commonly deployed, attackers may exploit this via network protocols that expose timing information (TLS handshakes, authentication challenges, etc.).

The vulnerability mechanism involves the compiler generating branching code paths instead of constant-time conditional moves. For technical details on the specific fix implemented, see the GitHub Security Advisory and the associated commit change.

Detection Methods for CVE-2026-23519

Indicators of Compromise

• Applications using RustCrypto CMOV library versions below 0.4.4
• Build targets configured for thumbv6m-none-eabi architecture
• Cargo.toml dependencies specifying vulnerable CMOV versions
• Timing variations observable in cryptographic operation response times

Detection Strategies

• Audit Cargo.lock files for RustCrypto CMOV dependencies with versions prior to 0.4.4
• Review build configurations for thumbv6m-none-eabi target specifications
• Analyze compiled assembly output for branching patterns in conditional move operations
• Deploy software composition analysis (SCA) tools to identify vulnerable library versions in firmware images

Monitoring Recommendations

• Implement firmware inventory management to track CMOV library versions across embedded device fleets
• Monitor for unusual timing patterns in cryptographic operations that may indicate exploitation attempts
• Establish baseline timing profiles for cryptographic functions to detect anomalous variations
• Configure alerts for dependency updates in RustCrypto ecosystem libraries

How to Mitigate CVE-2026-23519

Immediate Actions Required

• Upgrade RustCrypto CMOV library to version 0.4.4 or later immediately
• Rebuild all applications targeting thumbv6m-none-eabi with the patched library version
• Deploy updated firmware to affected Cortex M0/M0+/M1 devices
• Rotate any cryptographic keys that may have been processed by vulnerable implementations

Patch Information

The vulnerability is fixed in RustCrypto CMOV version 0.4.4. The patch ensures proper constant-time execution on ARMv6-M targets by implementing architecture-specific code paths that avoid compiler-generated branches. The fix can be reviewed in the GitHub commit.

To update the dependency, modify your Cargo.toml to require the fixed version:

Workarounds

• For systems unable to immediately upgrade, consider avoiding cryptographic operations on affected embedded platforms until patching is complete
• Implement additional timing noise or blinding countermeasures at the application layer as a temporary defense
• Restrict network access to vulnerable embedded devices to limit remote timing attack feasibility
• Use alternative cryptographic implementations with verified constant-time behavior on ARMv6-M if available

# Update Cargo.toml dependency
[dependencies]
cmov = ">=0.4.4"