PT-2025-24684 · Unknown · Matrix-Rust-Sdk

Richvdh · Published 2025-06-10 · Updated 2025-07-03 · CVE-2025-48937

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions matrix-rust-sdk versions 0.8.0 through 0.11.0

Description The issue arises from the failure to correctly validate the sender of an encrypted event in the matrix-sdk-crypto component. This allows a malicious homeserver operator to modify events served to clients, making those events appear to the recipient as if they were sent by another user.

Recommendations For versions 0.8.0 through 0.11.0, update to version 0.11.1 or 0.12.0 to resolve the issue.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2025-48937

GHSA-X958-RVG6-956W

OPENSUSE-SU-2025:15218-1

RUSTSEC-2025-0041

Affected Products

Matrix-Rust-Sdk

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48937.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-48937 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15218-1 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2025-0041 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x958-rvg6-956w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48937 · Vendor Advisory
• https://github.com/matrix-org/matrix-rust-sdk · Note
• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-x958-rvg6-956w · Note
• https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55 · Note
• https://github.com/matrix-org/matrix-rust-sdk/commit/56980745b4f27f7dc72ac296e6aa003e5d92a75b · Note
• https://crates.io/crates/matrix-sdk-crypto · Note
• https://twitter.com/CVEnew/status/1932465945764651349 · Twitter Post
• https://rustsec.org/advisories/RUSTSEC-2025-0041.html · Note
• https://suse.com/security/cve/CVE-2025-48937 · Note
• https://spec.matrix.org/v1.14/client-server-api/#mmegolmv1aes-sha2 · Note