CVE-2025-48937

Source
https://nvd.nist.gov/vuln/detail/CVE-2025-48937
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48937.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-48937
Aliases
Published
2025-06-10T15:32:00.822Z
Modified
2025-12-05T10:18:20.682535Z
Severity
  • 4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator
Details

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user. This vulnerability is fixed in 0.11.1 and 0.12.0.

Database specific
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-290"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48937.json"
}
References

Affected packages

Git / github.com/matrix-org/matrix-rust-sdk

Affected ranges

Type
GIT
Repo
https://github.com/matrix-org/matrix-rust-sdk
Events

Affected versions

matrix-sdk-0.*

matrix-sdk-0.10.0
matrix-sdk-0.11.0
matrix-sdk-0.8.0
matrix-sdk-0.9.0

matrix-sdk-base-0.*

matrix-sdk-base-0.10.0
matrix-sdk-base-0.11.0
matrix-sdk-base-0.8.0
matrix-sdk-base-0.9.0

matrix-sdk-common-0.*

matrix-sdk-common-0.10.0
matrix-sdk-common-0.11.0
matrix-sdk-common-0.8.0
matrix-sdk-common-0.9.0

matrix-sdk-crypto-0.*

matrix-sdk-crypto-0.10.0
matrix-sdk-crypto-0.11.0
matrix-sdk-crypto-0.8.0
matrix-sdk-crypto-0.9.0

matrix-sdk-crypto-ffi-0.*

matrix-sdk-crypto-ffi-0.11.0

matrix-sdk-ffi-0.*

matrix-sdk-ffi-0.11.0

Other

matrix-sdk-ffi/20241127
matrix-sdk-ffi/20241203
matrix-sdk-ffi/20241204
matrix-sdk-ffi/20250131
matrix-sdk-ffi/20250225
matrix-sdk-ffi/20250306
matrix-sdk-ffi/20250320
matrix-sdk-ffi/20250325
matrix-sdk-ffi/20250408
matrix-sdk-ffi/20252502

matrix-sdk-indexeddb-0.*

matrix-sdk-indexeddb-0.10.0
matrix-sdk-indexeddb-0.11.0
matrix-sdk-indexeddb-0.8.0
matrix-sdk-indexeddb-0.9.0

matrix-sdk-qrcode-0.*

matrix-sdk-qrcode-0.10.0
matrix-sdk-qrcode-0.11.0
matrix-sdk-qrcode-0.8.0
matrix-sdk-qrcode-0.9.0

matrix-sdk-sqlite-0.*

matrix-sdk-sqlite-0.10.0
matrix-sdk-sqlite-0.11.0
matrix-sdk-sqlite-0.8.0
matrix-sdk-sqlite-0.9.0

matrix-sdk-store-encryption-0.*

matrix-sdk-store-encryption-0.10.0
matrix-sdk-store-encryption-0.11.0
matrix-sdk-store-encryption-0.8.0
matrix-sdk-store-encryption-0.9.0

matrix-sdk-test-0.*

matrix-sdk-test-0.10.0
matrix-sdk-test-0.11.0

matrix-sdk-test-macros-0.*

matrix-sdk-test-macros-0.10.0
matrix-sdk-test-macros-0.11.0

matrix-sdk-ui-0.*

matrix-sdk-ui-0.10.0
matrix-sdk-ui-0.11.0
matrix-sdk-ui-0.8.0
matrix-sdk-ui-0.9.0