Matrix Specification vulnerabilities

2 CVEs affecting Matrix Specification, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-54315, published 2025-10-02.

More from Matrix.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-49090, published 2025-10-02. High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days. The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficient state resolution.
• CVE-2025-54315, published 2025-10-02. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.