Reported

September 11, 2025

Issued

September 11, 2025

Package

matrix-sdk-base (crates.io)

Type

Vulnerability

Aliases

• CVE-2025-59047
• GHSA-qhj8-q5r6-8q6j

References

• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-qhj8-q5r6-8q6j

Patched

• >=0.14.1

Affected Functions

Version

matrix_sdk_base::RoomMember::normalized_power_level

• <=0.14.0

Description

In matrix-sdk-base before 0.14.1, calling the RoomMember::normalized_power_level() method can cause a panic if a room member has a power level of Int::Min.

Advisory available under CC0-1.0 license.