CVE-2026-15814

EUVD-2026-77369

14.09.2026, 11:17

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a specially crafted image as a profile picture, channel file attachment, team icon, or custom brand image. Mattermost Advisory ID: MMSA-2026-00719

Data Amplification

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
Mattermost	CNA	6.5 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
mattermost	mattermost	𝑥 ≤ 11.9.0	CNA
mattermost	mattermost	11.8.0 ≤ 𝑥 ≤ 11.8.4	CNA
mattermost	mattermost	11.7.0 ≤ 𝑥 ≤ 11.7.7	CNA
mattermost	mattermost	10.11.0 ≤ 𝑥 ≤ 10.11.22	CNA

Common Weakness Enumeration

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

References

https://mattermost.com/security-updates