Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2025-31127: Element X Android can expose call encryption keys
CVE-2025-31127 · published 1 year ago
Summary
Versions of Element X Android from 0.4.16 up to 25.03.3 let anyone who controls a specific configuration file see the keys that protect video and audio during a call. This could let an attacker listen to or record private conversations. Updating the app to version 25.03.4 or later resolves the issue.
Original advisory text
Element X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call
Element X Android is a Matrix Android Client provided by element.io. In Element X Android versions between 0.4.16 and 25.03.3, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability is fixed in 25.03.4.
References
- https://github.com/element-hq/element-x-android/security/advisories/GHSA-x2g5-f2... Vendor Advisory
- https://github.com/element-hq/element-meta/issues/2441 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31127... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-31127 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-200Information Exposure
Timeline
Published3 Apr 2025
Updated30 Oct 2026
First seen7 Mar 2026
Track software like this
Free during beta