CVE-2025-31126: Element-Hq Element-X-IOS

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability is fixed in 25.03.8.

Affected products

• Element-Hq Element-X-IOS: from 1.6.13, before 25.03.8 (fixed in 25.03.8)

Published 2025-04-03. Last modified 2026-06-17.