Medium severity · published Sep 11, 2026
CVE-2026-45056
Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution
6.9
CVSS
0.3%
EPSS
No
On KEV
Description
matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients. Starting in version 0.12.0 and prior to version 0.17.0, the matrix-sdk-crypto crate was missing a check for the user ID when decrypting an Olm-encrypted event containing the `sender_device_keys` property. This could be exploited to forge an encrypted to-device event, but only if the attacker colludes with the homeserver operator. This issue is fixed in matrix-sdk-crypto 0.17.0. There are no known workarounds for the issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
matrix-rust-sdk · matrix-org
>= 0.12.0, < 0.16.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45056
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45056
github.com
https://github.com/matrix-org/matrix-rust-sdk/pull/6553
github.com
https://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.16.1
github.com
https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-wfq4-36m3-9g42
rustsec.org
https://rustsec.org/advisories/RUSTSEC-2026-0159.html
More from matrix-rust-sdk
7.5
CVE-2025-66622
matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values
7.5
CVE-2022-39252
When matrix-rust-sdk recieves forwarded room keys, the reciever doesn't check if it requested the key from the forwarder
5.2
CVE-2025-53549
Matrix Rust SDK allows SQL injection in the EventCache implementation
4.9
CVE-2025-48937
matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator
4.3
CVE-2024-52813
matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity