CVE-2022-39255

CVE-2022-39255 is a protocol confusion vulnerability in the Matrix iOS SDK (versions prior to 0.23.19) that allows a malicious homeserver, in coordination with an attacker, to forge messages and to-device messages appearing to originate from legitimate users. This can lead to the injection of a malicious key backup secret during self-verification, potentially compromising end-to-end encryption. The vulnerability has a CVSS score of 7.5 (HIGH) due to its network-based attack vector and high impact on integrity, requiring no user interaction. While there is no evidence of active exploitation or public exploit code, the vulnerability has received some community discussion and media coverage, indicating awareness.