State Machine Vulnerability in Matrix SDK Crypto Affecting End-to-End Encryption
CVE-2026-45056

6.9MEDIUM

Key Information:

Vendor

Matrix-org

Status
Matrix-rust-sdk
Vendor
CVE Published:
11 September 2026

What is CVE-2026-45056?

The matrix-sdk-crypto library, which manages end-to-end encryption for Matrix clients, lacked essential validation for user IDs during the decryption process of Olm-encrypted events that included the sender_device_keys attribute. This oversight allows an attacker, in collusion with the homeserver operator, to potentially forge encrypted to-device messages. The vulnerability was addressed in version 0.17.0 of the matrix-sdk-crypto library, with no available workarounds for affected versions.

Affected Version(s)

matrix-rust-sdk >= 0.12.0, < 0.16.1

References

https://github.com/matrix-org/matrix-rust-sdk/security/ad...
x_refsource_CONFIRM
https://github.com/matrix-org/matrix-rust-sdk/pull/6553
x_refsource_MISC
https://github.com/matrix-org/matrix-rust-sdk/releases/ta...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.