PT-2025-11282 · Element · Element Android

Published 2025-03-14 · Updated 2025-03-14 · CVE-2025-27606

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Element Android versions 1.6.32 and earlier

Description: The issue occurs when the user inputs the wrong PIN more than the configured amount of times, causing the application to fail to logout the user under certain circumstances. An attacker with physical access to a device can exploit this to guess the PIN.

Recommendations: For versions 1.6.32 and earlier, update to version 1.6.34 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-488

Related Identifiers

CVE-2025-27606

GHSA-632V-9PM3-M8CH

Affected Products

Element Android

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27606.json · Exploit
• https://github.com/element-hq/element-android/security/advisories/GHSA-632v-9pm3-m8ch · Vendor Advisory
• https://github.com/element-hq/element-android/commit/87d7fcdc8036a4db4da8c403f87c73a64a546304 · Patch
• https://github.com/element-hq/element-android/commit/53bd78b05de375c6e6b0b5aa794a56b4ba95984c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-27606 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27606 · Vendor Advisory
• https://twitter.com/CVEnew/status/1900595886952010219 · Twitter Post
• https://t.me/cvedetector/20309 · Telegram Post
• https://t.me/cvetracker/19137 · Telegram Post