Answer in brief
CVE-2026-45056 records a Medium severity vulnerability in Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution. The current sources do not mark it as known exploited. The current feed maps matrix-org/matrix-rust-sdk (generic), matrix-sdk-crypto (rust). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps matrix-org/matrix-rust-sdk (generic), matrix-sdk-crypto (rust). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| matrix-org/matrix-rust-sdkgeneric | >= 0.12.0, < 0.16.1 | Not reported |
| matrix-sdk-cryptorust | >=0.12.0,<0.16.1 | 0.16.1 |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 11, 2026
matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients. Starting in version 0.12.0 and prior to version 0.17.0, the matrix-sdk-crypto crate was missing a check for the user ID when decrypting an Olm-encrypted event containing the `sender_device_keys` property. This could be exploited to forge an encrypted to-device event, but only if the attacker colludes with the homeserver operator. This issue is fixed in matrix-sdk-crypto 0.17.0. There are no known workarounds for the issue.
Quoted source text, attributed separately from HOL analysis.