{"id":"CVE-2026-56898","kind":"vulnerability","aliases":["CVE-2026-56898"],"related":[],"title":"aes.rs: AES-CMAC lets attackers forge message authentication codes locally","description":"In aes256_cmac_sw of aes.rs, there is a possible way to forge message authentication codes over multi-block messages due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"In aes256_cmac_sw in aes.rs, multi-block messages can have forged message authentication codes because of improper use of cryptography. An attacker with local access could use this to escalate privileges without extra execution rights or user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aes.rs","other","rust"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:14+00:00","first_seen_at":"2026-11-10T20:46:06+00:00","triaged_at":"2026-11-10T20:53:55+00:00","updated_at":"2026-11-10T20:53:55+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T20:53:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"aes.rs: AES-CMAC lets attackers forge message authentication codes locally","impact":"high","summary":"In aes256_cmac_sw in aes.rs, multi-block messages can have forged message authentication codes because of improper use of cryptography. An attacker with local access could use this to escalate privileges without extra execution rights or user interaction.","audience":"businesses","category":"other","nicknames":[],"who_cares":["aes.rs","rust"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local privilege escalation through forged message authentication codes","analyst_note":"Identify the affected crate or product, its vulnerable and fixed versions, and whether the NVD entry or vendor advisory names them.","how_to_check":"unknown","plain_action":"","product_name":"aes.rs","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected product or version range, so the team cannot tell from this signal alone whether a system it runs uses the aes.rs AES-CMAC software implementation. Systems where local users or processes can reach the affected code path are the ones to look at. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000686,"input_tokens":4538,"output_tokens":465,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-56898':14A,17A 'access':47B 'addit':97C 'ae':3A 'aes-cmac':2A 'aes.rs':1A,18B,26B,66C 'aes256':22B,62C 'attack':6A,44B 'authent':9A,35B,75C 'block':29B,80C 'cmac':4A,23B,63C 'code':10A,36B,76C 'could':48B,88C 'crypto':86C 'cryptographi':42B 'cve':12A,15A 'due':82C 'escal':52B,92C 'execut':56B,98C 'exploit':107C 'extra':55B 'forg':7A,33B,73C 'improp':39B,84C 'interact':60B,102C 'lead':89C 'let':5A 'local':11A,46B,91C 'messag':8A,30B,34B,74C,81C 'multi':28B,79C 'multi-block':27B,78C 'need':100C,105C 'possibl':70C 'privileg':53B,94C,99C 'right':57B 'rust':20B 'sw':24B,64C 'use':40B,49B,85C 'user':59B,101C 'way':71C 'without':54B","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected product or version range, so the team cannot tell from this signal alone whether a system it runs uses the aes.rs AES-CMAC software implementation. Systems where local users or processes can reach the affected code path are the ones to look at. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aesrs","other","rust","unknown"],"campaign_type":null,"search_a":"'-2026':13A,16A '-56898':14A,17A 'ae':3A 'aes-cmac':2A 'aes.rs':1A 'attack':6A 'authent':9A 'cmac':4A 'code':10A 'cve':12A,15A 'forg':7A 'let':5A 'local':11A 'messag':8A","search_b":"'access':47B 'aes.rs':18B,26B 'aes256':22B 'attack':44B 'authent':35B 'block':29B 'cmac':23B 'code':36B 'could':48B 'cryptographi':42B 'escal':52B 'execut':56B 'extra':55B 'forg':33B 'improp':39B 'interact':60B 'local':46B 'messag':30B,34B 'multi':28B 'multi-block':27B 'privileg':53B 'right':57B 'rust':20B 'sw':24B 'use':40B,49B 'user':59B 'without':54B","search_c":"'addit':97C 'aes.rs':66C 'aes256':62C 'authent':75C 'block':80C 'cmac':63C 'code':76C 'could':88C 'crypto':86C 'due':82C 'escal':92C 'execut':98C 'exploit':107C 'forg':73C 'improp':84C 'interact':102C 'lead':89C 'local':91C 'messag':74C,81C 'multi':79C 'multi-block':78C 'need':100C,105C 'possibl':70C 'privileg':94C,99C 'sw':64C 'use':85C 'user':101C 'way':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56898","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56898","severity":null,"published_at":"2026-11-10T20:19:14+00:00","modified_at":"2026-11-10T20:19:14+00:00","first_seen_at":"2026-11-10T20:46:06+00:00","fetched_at":"2026-11-10T20:46:06+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}