CVE-2026-45057: Matrix matrix-sdk-ui incomplete message edit validation

CVE-2026-45057 · Severity: medium · CVSS 4.9 · Published 2026-09-11

A vulnerability in the Matrix Rust SDK's user interface library could allow a malicious server administrator to spoof messages. The software fails to ensure that edits to encrypted messages are also encrypted, allowing an attacker to replace legitimate secure communications with unencrypted fraudulent content. This could lead to impersonation of users within a Matrix-based chat application.

Vendors: crates.io, Matrix.org.

Quick answers

Is CVE-2026-45057 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45057 being exploited in the wild.
How severe is CVE-2026-45057?
Medium severity, with a CVSS score of 4.9, published 11 September 2026.
Which products and versions are affected?
matrix-sdk-ui (crates.io) < 0.16.1, SEMVER:introduced=0,fixed=0.16.1, SEMVER:introduced=0.0.0-0,fixed=0.16.1.
Is there a fix for CVE-2026-45057?
Yes. matrix-sdk-ui (crates.io): upgrade to 0.16.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45057 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45057?
Check whether you run matrix-sdk-ui (crates.io) or Matrix.org Matrix-Sdk-Ui-Android at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • matrix-sdk-ui (crates.io): upgrade to 0.16.1 or later
    cargo update -p matrix-sdk-ui

Technical details

The matrix-sdk-ui crate fails to properly validate replacement events (edits) for encrypted messages. Specifically, the logic does not enforce that a replacement event for an encrypted event must also be encrypted. A malicious homeserver administrator or an attacker with equivalent network privileges can exploit this by injecting unencrypted replacement events to impersonate users or spoof message content. This violates the Matrix specification regarding the validity of replacement events. The issue is fixed in version 0.16.1 by aligning the validation logic with the official Matrix algorithm.

Affected products

  • Matrix.org matrix-sdk-ui < 0.16.1

Identifiers

  • CVE-2026-45057
  • GHSA-h97m-27fx-42rx
  • RUSTSEC-2026-0158

Timeline

  • 2026-04-17: patched: Pull request merged into main branch
  • 2026-05-08: advisory: Release 0.16.1 published
  • 2026-06-04: disclosed: Public security advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.