CVE-2025-31127: Element-Hq Element-X-Android

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Element X Android is a Matrix Android Client provided by element.io. In Element X Android versions between 0.4.16 and 25.03.3, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability is fixed in 25.03.4.

Affected products

• Element-Hq Element-X-Android: from 0.4.16, before 25.03.4 (fixed in 25.03.4)

Published 2025-04-03. Last modified 2026-06-17.