Sending custom to-device messages may panics

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Using the `IdentityBasedStrategy` setting when calling `Device::encrypt_event_raw` or `OlmMachine::encrypt_content_for_devices` may cause a panic if the recipient does not have cross-signing keys.

Source published

29 Sep 2026 12:00:00 UTC

Source modified

1 Oct 2026 20:30:02 UTC

Observed here

24 Oct 2026 13:19:54 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.