« Volver al listado

CVE-2025-31126

Estado: AplazadaMedia (5.3)—

Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability is fixed in 25.03.8.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Element — Element X IOSAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-31126",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-31126",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-07T18:23:56.839530Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "element-hq",
          "product": "element-x-ios",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.6.13, < 25.03.8"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-04-03T18:15:45.803",
  "references": [
    {
      "url": "https://github.com/element-hq/element-meta/issues/2441",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/element-hq/element-x-ios/security/advisories/GHSA-69qf-p24v-rf8j",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability is fixed in 25.03.8."
    },
    {
      "lang": "es",
      "value": "Element X iOS es un cliente Matrix iOS proporcionado por Element. En las versiones de Element X iOS entre la 1.6.13 y la 25.03.7, la entidad que controla el archivo conocido element.json puede, bajo ciertas condiciones, acceder a las claves de cifrado de medios utilizadas para una llamada de Element. Esta vulnerabilidad se corrigió en la versión 25.03.8."
    }
  ],
  "lastModified": "2026-06-17T09:09:54.150",
  "sourceIdentifier": "security-advisories@github.com"
}