CVE-2025-31127: Element X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call
Element X Android is a Matrix Android Client provided by element.io. In Element X Android versions between 0.4.16 and 25.03.3, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability is fixed in 25.03.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31127?
CVE-2025-31127 is categorized as a critical severity vulnerability due to its potential to expose media encryption keys.
How do I fix CVE-2025-31127?
To fix CVE-2025-31127, update Element X Android to a version beyond 25.03.3 or the latest available release.
What versions of Element X Android are affected by CVE-2025-31127?
CVE-2025-31127 affects Element X Android versions between 0.4.16 and 25.03.3.
What can an attacker do with CVE-2025-31127?
An attacker exploiting CVE-2025-31127 may gain unauthorized access to media encryption keys, potentially compromising media confidentiality.
Is there a known exploit for CVE-2025-31127?
As of now, there are no publicly disclosed active exploits for CVE-2025-31127, but the vulnerability itself poses significant risks.