Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-45056 · Microsoft / collected KEV context

EUVD-2026-76763

GHSA-wfq4-36m3-9g42

RUSTSEC-2026-0159

cve-program · CVE-2026-45056

• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-wfq4-36m3-9g42
• https://github.com/matrix-org/matrix-rust-sdk/pull/6553
• https://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.16.1
• https://rustsec.org/advisories/RUSTSEC-2026-0159.html

euvd · EUVD-2026-76763

• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-wfq4-36m3-9g42
• https://github.com/matrix-org/matrix-rust-sdk/pull/6553
• https://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.16.1
• https://rustsec.org/advisories/RUSTSEC-2026-0159.html

nvd · CVE-2026-45056

• https://github.com/matrix-org/matrix-rust-sdk/pull/6553
• https://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.16.1
• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-wfq4-36m3-9g42
• https://rustsec.org/advisories/RUSTSEC-2026-0159.html

osv · GHSA-wfq4-36m3-9g42

• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-wfq4-36m3-9g42
• https://github.com/matrix-org/matrix-rust-sdk/pull/6553
• https://github.com/matrix-org/matrix-rust-sdk
• https://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.16.1
• https://rustsec.org/advisories/RUSTSEC-2026-0159.html

osv · RUSTSEC-2026-0159

• https://crates.io/crates/matrix-sdk-crypto
• https://rustsec.org/advisories/RUSTSEC-2026-0159.html
• https://github.com/matrix-org/matrix-rust-sdk/pull/6553

No related operational record is retained in the current change model.