CVE-2025-59047
matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method
Description
matrix-sdk-base is the base component to build a Matrix client library. In matrix-sdk-base before 0.14.1, calling the `RoomMember::normalized_power_level()` method can cause a panic if a room member has a power level of `Int::Min`. The issue is fixed in matrix-sdk-base 0.14.1. The affected method isn’t used internally, so avoiding calling `RoomMember::normalized_power_level()` prevents the panic.
No summary for this CVE yet.
Weaknesses
Affected Products
matrix-org
oss-project·DEaka matrix-js-sdk, matrix appservice irc, synapse
crates.io
package-ecosystem
Exploitability
Official Patch Available
References
https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-qhj8-q5r6-8q6j
github.com
https://github.com/matrix-org/matrix-rust-sdk/pull/5635
github.com
https://github.com/matrix-org/matrix-rust-sdk/commit/ce3b67f801446387972ff120e907ca828a9f1207
github.com
and 4 more references View all →
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2025-59047 and every CVE in our database. Create a free account — no credit card required.
Create Free AccountPlain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows