Threat database

CVE-2026-23519 is a high-severity vulnerability in RustCrypto utils prior to version 0.4.4, where the conditional move CPU intrinsic (cmovnz) does not execute in constant time on the thumbv6m-none-eabi platform (Cortex M0, M0+, M1). This timing discrepancy can lead to observable side-channel leaks, potentially exposing sensitive information. The flaw arises because the compiler emits non-constant time assembly code, violating the constant-time guarantee critical for cryptographic operations. No known exploits are currently in the wild, but the vulnerability affects embedded systems using these RustCrypto utils on vulnerable platforms. The issue is fixed in version 0.4.4. European organizations using embedded devices with Cortex M0/M0+/M1 processors and RustCrypto utils versions before 0.