Vulnerability in Matrix Client Library Affects matrix-sdk-base Component
CVE-2025-59047

2.7LOW

Key Information:

Vendor

Matrix-org

Status
Matrix-rust-sdk
Vendor
CVE Published:
11 September 2025

What is CVE-2025-59047?

The matrix-sdk-base component, utilized for building Matrix client libraries, harbors a potential issue prior to version 0.14.1. A method, RoomMember::normalized_power_level(), can induce a panic under specific circumstances when a room member's power level registers as Int::Min. Although this is a non-internal method and can be circumvented by avoiding its invocation, it is crucial for developers to update to version 0.14.1 or later to ensure stability and eliminate this risk.

Affected Version(s)

matrix-rust-sdk < 0.14.1

References

https://github.com/matrix-org/matrix-rust-sdk/security/ad...
x_refsource_CONFIRM
https://github.com/matrix-org/matrix-rust-sdk/pull/5635
x_refsource_MISC
https://github.com/matrix-org/matrix-rust-sdk/commit/ce3b...
x_refsource_MISC

CVSS V4

Score:
2.7
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-59047 : Vulnerability in Matrix Client Library Affects matrix-sdk-base Component