CVE-2025-31127CWE-200

Element X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call

Medium · published April 3, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
9.4
In the wild
Unconfirmed
What it is

Element X Android is a Matrix Android Client provided by element.io. In Element X Android versions between 0.4.16 and 25.03.3, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability is fixed in 25.03.4.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00200 · 9.4th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-04-03T17:54Z
EPSS history
Timeline
  • 03 APR 17:54Z
    Element X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call
    cvelistv5