CVE-2026-50185

A flaw was found in the cmov component of RustCrypto. The aarch64 implementations of Cmov and CmovEq incorrectly assume that high bits are zero-extended when loading values smaller than a register. This can lead to incorrect output when certain high bits are set in a Cmov selector or in the u16 and i16 CmovEq implementations. This vulnerability could result in a low impact on data integrity.

This vulnerability is assessed with a Low severity rating because it is architecture-specific to ARM64 (aarch64) hardware and results strictly in limited data integrity degradation without granting privilege escalation or code execution. Workloads running on alternative architectures such as x86_64 are not affected by this flaw. Furthermore, triggering the condition requires local execution contexts where targeted applications handle narrow integer values containing unexpected upper register bits during conditional operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.