CVE-2026-15814
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Uploading a crafted image causes excessive memory allocation in the Mattermost Server
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a specially crafted image as a profile picture, channel file attachment, team icon, or custom brand image. Mattermost Advisory ID: MMSA-2026-00719
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Mattermost
- Vendor
- Mattermost
- Product
- Mattermost
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 11.9.0 | affected | semver | Unavailable | 11.9.0 | None listed |
| 11.8.0 | affected | semver | Unavailable | 11.8.4 | None listed |
| 11.7.0 | affected | semver | Unavailable | 11.7.7 | None listed |
| 10.11.0 | affected | semver | Unavailable | 10.11.22 | None listed |
| 11.10.0 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
| 11.9.1 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
| 11.8.5 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
| 11.7.8 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
| 10.11.23 | unaffected | Unavailable | Unavailable | Unavailable | None listed |