CVE-2025-31126 Element X iOS allows the entity in control of the well-known file to break the confidentiality of embedded Element Call
An attacker controlling the well-known file can access media encryption keys for Element Call, compromising call confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-31126?
CVE-2025-31126 is a medium-severity vulnerability in element-hq element-x-ios, published on 3 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability is fixed in 25.03.8.
Weakness: CWE-200
Which versions are affected by CVE-2025-31126?
How do I fix CVE-2025-31126?
No fix has been published for CVE-2025-31126 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-31126 being exploited?
There is no known exploitation of CVE-2025-31126 in the wild and no public exploit code.
Sources
Also known as GHSA-69qf-p24v-rf8j.