{"id":"EUVD-2026-76763","enisaUuid":"6dfcf2b5-18d3-38da-bf7c-decc67081f55","description":"matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients. Starting in version 0.12.0 and prior to version 0.17.0, the matrix-sdk-crypto crate was missing a check for the user ID when decrypting an Olm-encrypted event containing the `sender_device_keys` property. This could be exploited to forge an encrypted to-device event, but only if the attacker colludes with the homeserver operator. This issue is fixed in matrix-sdk-crypto 0.17.0. There are no known workarounds for the issue.","datePublished":"Sep 11, 2026, 9:13:56 PM","dateUpdated":"Sep 14, 2026, 6:17:31 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-wfq4-36m3-9g42\nhttps://github.com/matrix-org/matrix-rust-sdk/pull/6553\nhttps://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.16.1\nhttps://rustsec.org/advisories/RUSTSEC-2026-0159.html\n","aliases":"CVE-2026-45056\nGHSA-wfq4-36m3-9g42\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"4956a81c-9422-3abc-b536-f6c690b0b5b1","product":{"name":"matrix-rust-sdk","vendor":{"name":"matrix-org"}},"product_version":"0.12.0, \u003c 0.16.1"}],"enisaIdVendor":[{"id":"cd656720-f68a-3d9a-8a30-f89b3b83bee8","vendor":{"name":"matrix-org"}}],"enisaIdVulnerability":[{"id":"0eaa55c8-a66c-37a1-971d-bacf7d436f15","vulnerability":{"id":"CVE-2026-45056","description":"matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients. Starting in version 0.12.0 and prior to version 0.17.0, the matrix-sdk-crypto crate was missing a check for the user ID when decrypting an Olm-encrypted event containing the `sender_device_keys` property. This could be exploited to forge an encrypted to-device event, but only if the attacker colludes with the homeserver operator. This issue is fixed in matrix-sdk-crypto 0.17.0. There are no known workarounds for the issue.","datePublished":"Sep 11, 2026, 9:13:56 PM","dateUpdated":"Sep 14, 2026, 6:17:31 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-wfq4-36m3-9g42\nhttps://github.com/matrix-org/matrix-rust-sdk/pull/6553\nhttps://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.16.1\nhttps://rustsec.org/advisories/RUSTSEC-2026-0159.html\n","enisa_id":"EUVD-2026-76763\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Nov 3, 2026, 7:17:32 AM","vulnerabilityProduct":[{"id":"44581a31-ea8f-3a12-9d92-bcf281a8d495","product":{"name":"matrix-rust-sdk","vendor":{"name":"matrix-org"}},"product_version":"0.12.0, \u003c 0.16.1"}],"vulnerabilityVendor":[{"id":"fd8b8d35-a578-3420-91d4-e31cb42e37e0","vendor":{"name":"matrix-org"}}]}},{"id":"26f4ed00-bf94-34c4-ae68-c208bfda3646","vulnerability":{"id":"GHSA-wfq4-36m3-9g42","description":"Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution","datePublished":"Jun 4, 2026, 2:47:05 PM","dateUpdated":"Jun 4, 2026, 2:47:05 PM","baseScore":0.0,"references":"https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-wfq4-36m3-9g42\nhttps://github.com/matrix-org/matrix-rust-sdk/pull/6553\nhttps://github.com/matrix-org/matrix-rust-sdk\nhttps://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.16.1\nhttps://rustsec.org/advisories/RUSTSEC-2026-0159.html\n","enisa_id":"EUVD-2026-76763\n","aliases":"GHSA-wfq4-36m3-9g42\nCVE-2026-45056\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}