---
id: "CVE-2026-56898"
page: "https://infrastack.ai/live/CVE-2026-56898"
kind: "vulnerability"
aliases: ["CVE-2026-56898"]
title: "aes.rs: AES-CMAC lets attackers forge message authentication codes locally"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["aes.rs", "other", "rust"]
not_affected_if: []
published_at: "2026-11-10T20:19:14+00:00"
first_seen_at: "2026-11-10T20:46:06+00:00"
updated_at: "2026-11-10T20:53:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56898", "first_seen_at": "2026-11-10T20:46:06+00:00"}]
exploit_sources: []
---

# aes.rs: AES-CMAC lets attackers forge message authentication codes locally

Link for people: https://infrastack.ai/live/CVE-2026-56898 (this .md is for agents)

In aes256_cmac_sw in aes.rs, multi-block messages can have forged message authentication codes because of improper use of cryptography. An attacker with local access could use this to escalate privileges without extra execution rights or user interaction.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T20:46:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-56898

## From the sources

In aes256_cmac_sw of aes.rs, there is a possible way to forge message authentication codes over multi-block messages due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_