CVE-2025-31126: Element X iOS allows the entity in control of the well-known file to break the confidentiality of embedded Element Call
Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability is fixed in 25.03.8.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31126?
CVE-2025-31126 has a high severity rating due to its potential exploitation that allows unauthorized access to media encryption keys.
How do I fix CVE-2025-31126?
To fix CVE-2025-31126, upgrade Element X iOS to a version later than 25.03.7.
What versions of Element X iOS are affected by CVE-2025-31126?
Element X iOS versions from 1.6.13 to 25.03.7 are affected by CVE-2025-31126.
What are the potential impacts of CVE-2025-31126?
CVE-2025-31126 can lead to unauthorized access to sensitive media encryption keys used during Element Calls.
Who is responsible for addressing CVE-2025-31126?
The Element development team is responsible for addressing CVE-2025-31126 through software updates.