JetBrains YouTrack CVE-2026-103492

Requires a valid authenticated YouTrack account with permission to add attachments (PR:L), and the ability to deliver a crafted PSD file to the attachment-processing path on an instance running a version before 2026.2.19422. Exploitation is limited by the authentication requirement - not reachable by fully anonymous users unless the instance permits self-registration or guest attachment upload - and impact is confined to availability (service hang/crash) of the YouTrack server; no user interaction by a victim is needed (UI:N).

Moderate, operations-focused risk. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5) is internally consistent with the description: a network-reachable but authenticated (PR:L) attacker triggers a pure availability impact (A:H) with no confidentiality or integrity loss, matching CWE-835 (loop-with-unreachable-exit / resource exhaustion). This is a denial-of-service bug, not a code-execution or data-exposure flaw, so despite the 'Medium' score the ceiling of damage is bounded to service disruption of the YouTrack instance. No EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the provided data, so there is no public exploit identified at time of analysis and no signal of active exploitation. The authentication requirement (PR:L) meaningfully limits exposure - an attacker must already hold a valid low-privilege YouTrack account able to upload attachments - which reduces this from an internet-wide risk to an insider/compromised-account or open-registration risk. Overall this is a legitimate availability hardening fix to patch on a normal cycle rather than an emergency. No key signals conflict; the main gap is the lack of a technical advisory (the only reference is JetBrains' general issues-fixed page), so the exact parsing component and whether the condition is a crash, hang, or memory exhaustion cannot be confirmed from available data.

An attacker with an ordinary authenticated YouTrack account (or via self-registration where enabled) creates or comments on an issue and attaches a maliciously crafted PSD (Photoshop) file. When YouTrack's attachment/thumbnail processing parses the malformed PSD, it enters an uncontrolled loop or resource-exhaustion condition (CWE-835), degrading or hanging the service for all users. No public proof-of-concept is identified at time of analysis, and the attack requires valid low-privilege credentials rather than being fully unauthenticated.