{"id":"EUVD-2026-76763","revision":"f7e368b27a684a7ea8497fe5ff14c794","records":[{"revision":"f7e368b27a684a7ea8497fe5ff14c794","observedAt":"2026-11-07T13:22:52.769+00:00","statement":{"source":"euvd","id":"EUVD-2026-76763","aliases":["CVE-2026-45056","GHSA-wfq4-36m3-9g42"],"title":"matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients. Starting in version 0.12.0 and prior to version 0.17.0, the matrix-sdk-crypto crate was missing a check for the us…","description":"matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients. Starting in version 0.12.0 and prior to version 0.17.0, the matrix-sdk-crypto crate was missing a check for the user ID when decrypting an Olm-encrypted event containing the `sender_device_keys` property. This could be exploited to forge an encrypted to-device event, but only if the attacker colludes with the homeserver operator. This issue is fixed in matrix-sdk-crypto 0.17.0. There are no known workarounds for the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":6.9,"severity":null}],"references":["https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-wfq4-36m3-9g42","https://github.com/matrix-org/matrix-rust-sdk/pull/6553","https://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.16.1","https://rustsec.org/advisories/RUSTSEC-2026-0159.html"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-76763","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 11, 2026, 9:13:56 PM","dateUpdated":"Sep 14, 2026, 6:17:31 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-76763","identifiers":["EUVD-2026-76763","CVE-2026-45056","GHSA-wfq4-36m3-9g42"]},"retained":false,"historicalAffected":[]}],"coverage":[]}