What is the CVSS score of CVE-2026-5755?

CVE-2026-5755 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5755?

Yes, a patch is available for CVE-2026-5755. Update the affected software to the latest version immediately.

Mattermost CVE-2026-5755

Q: Which versions of Mattermost are affected by CVE-2026-5755?

Uncontrolled memory allocation in Mattermost's TIFF image processing allows authenticated users to trigger server-side out-of-memory (OOM) conditions, effectively taking down the collaboration…. A patch is available.

EUVD-2026-31427 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-05-22 Mattermost

GHSA-37j2-3vv8-cf24

File Upload Denial Of Service Mattermost

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 22, 2026 - 11:32 vuln.today

DescriptionCVE.org

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.2, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the TIFF IFD offset in the image header before allocating memory, which allows authenticated users with file upload or posting permissions to cause a denial of service (server OOM) via uploading a crafted TIFF file or posting a URL that serves one.. Mattermost Advisory ID: MMSA-2026-00648

AnalysisAI

Uncontrolled memory allocation in Mattermost's TIFF image processing allows authenticated users to trigger server-side out-of-memory (OOM) conditions, effectively taking down the collaboration platform. Affected are all Mattermost deployments running versions 10.11.x through 11.6.0. Any account holding file upload or URL-posting permissions can exploit this remotely without elevated privileges, making it a realistic insider or compromised-account threat. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad authentication base increase practical risk.

Technical ContextAI

Mattermost (CPE: cpe:2.3:a:mattermost:mattermost) includes a server-side TIFF image parser used during file uploads and URL preview rendering. The TIFF format uses Image File Directory (IFD) structures with offset fields that point to data locations within the file. The vulnerability (CWE-400: Uncontrolled Resource Consumption) arises because Mattermost does not validate the IFD offset value from the TIFF image header before using it to drive memory allocation. An attacker can craft a TIFF file with a maliciously large or nonsensical IFD offset, causing the server to attempt an enormous heap allocation, exhausting available RAM and triggering an OOM condition that crashes or severely degrades the server process. This class of vulnerability is common in image-processing libraries that parse attacker-controlled binary formats without bounds-checking header fields prior to resource allocation.

RemediationAI

The primary remediation is to upgrade Mattermost server to a fixed version per the vendor security advisory at https://mattermost.com/security-updates (MMSA-2026-00648). Exact patched version numbers are not independently confirmed from the available input data - consult the advisory page directly to identify the minimum safe release for your branch (10.11.x, 11.4.x, 11.5.x, or 11.6.x). As a compensating control while patching is coordinated, administrators can restrict file upload and URL-preview permissions to a reduced set of trusted users or roles within Mattermost's System Console, which reduces the attack surface at the cost of feature availability for general users. Disabling TIFF-format support at the reverse proxy or application layer (if configurable) would eliminate the vulnerable code path entirely, though this may break legitimate workflows involving TIFF files. Rate-limiting file upload API endpoints can reduce the impact of repeated exploitation attempts but will not prevent a single well-crafted request from consuming excessive memory.