How severe is CVE-2025-27606?

CVE-2025-27606 has a CVSS 3.x base score of 5.1, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2025-27606 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-27606?

CVE-2025-27606 affects Element. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-27606?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-27606 have an EU (EUVD) identifier?

Yes. CVE-2025-27606 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-7798.

When was CVE-2025-27606 published?

CVE-2025-27606 was published on 2025-03-14 and last updated on 2026-06-17.

CVE-2025-27606

CVE-2025-27606 is a medium-severity vulnerability in Element with a CVSS 3.x base score of 5.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-488.

Key facts

Severity: Medium (CVSS 3.x base score 5.1)
EPSS exploit prediction: 0% (9th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-7798
Weakness: CWE-488
Affected product: Element
Published: 2025-03-14
Last modified: 2026-06-17

Description

Element Android is an Android Matrix Client provided by Element. Element Android up to version 1.6.32 can, under certain circumstances, fail to logout the user if they input the wrong PIN more than the configured amount of times. An attacker with physical access to a device can exploit this to guess the PIN. Version 1.6.34 solves the issue.

Frequently asked questions

What is CVE-2025-27606?: Element Android is an Android Matrix Client provided by Element. Element Android up to version 1.6.32 can, under certain circumstances, fail to logout the user if they input the wrong PIN more than the configured amount of times. An attacker with physical access to a device can exploit this to guess the PIN. Version 1.6.34 solves the issue.
How severe is CVE-2025-27606?: CVE-2025-27606 has a CVSS 3.x base score of 5.1, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2025-27606 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-27606?: CVE-2025-27606 affects Element. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-27606?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-27606 have an EU (EUVD) identifier?: Yes. CVE-2025-27606 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-7798.
When was CVE-2025-27606 published?: CVE-2025-27606 was published on 2025-03-14 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:element:element:*:*:*:*:*:android:*:*

More vulnerabilities in Element

CVE-2024-26131 — High (CVSS 8.4): Element Android is an Android Matrix Client. Element Android version 1.4.3 through 1.6.10 is vulnerable to intent…
CVE-2022-41904 — Medium (CVSS 6.4): Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events…
CVE-2024-26132 — Medium (CVSS 4.0): Element Android is an Android Matrix Client. A third-party malicious application installed on the same phone can force…

All CVEs affecting Element →

Other CWE-488 vulnerabilities

CVE-2026-16326 — Critical (CVSS 10.0): In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may…
CVE-2026-16498 — Critical (CVSS 10.0): The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the…
CVE-2025-47928 — Critical (CVSS 9.1): Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using…
CVE-2024-27455 — Critical (CVSS 9.1): In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token…
CVE-2025-1247 — High (CVSS 8.3): A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use…
CVE-2024-38367 — High (CVSS 8.2): trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit…

Browse all CWE-488 vulnerabilities →