CVE-2025-59047CWE-682

matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method

Low · published September 11, 2025

CVSS v4.0
2.7
EPSS
0%
Percentile
33.2
In the wild
Unconfirmed
What it is

matrix-sdk-base is the base component to build a Matrix client library. In matrix-sdk-base before 0.14.1, calling the `RoomMember::normalized_power_level()` method can cause a panic if a room member has a power level of `Int::Min`. The issue is fixed in matrix-sdk-base 0.14.1. The affected method isn’t used internally, so avoiding calling `RoomMember::normalized_power_level()` prevents the panic.

The record
Technical detail
CVSS v4.0
2.7 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
EPSS
0.00401 · 33.2th percentile
Weakness
CWE-682 · Incorrect Calculation
Published
2025-09-11T18:03Z
EPSS history
Timeline
  • 11 SEP 18:03Z
    matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method
    cvelistv5