EUVD-2026-31427
GHSA-37j2-3vv8-cf24
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (Mattermost).
CVSS VectorVendor: Mattermost
Lifecycle Timeline
1DescriptionCVE.org
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.2, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the TIFF IFD offset in the image header before allocating memory, which allows authenticated users with file upload or posting permissions to cause a denial of service (server OOM) via uploading a crafted TIFF file or posting a URL that serves one.. Mattermost Advisory ID: MMSA-2026-00648
AnalysisAI
Uncontrolled memory allocation in Mattermost's TIFF image processing allows authenticated users to trigger server-side out-of-memory (OOM) conditions, effectively taking down the collaboration platform. Affected are all Mattermost deployments running versions 10.11.x through 11.6.0. Any account holding file upload or URL-posting permissions can exploit this remotely without elevated privileges, making it a realistic insider or compromised-account threat. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad authentication base increase practical risk.
Technical ContextAI
Mattermost (CPE: cpe:2.3:a:mattermost:mattermost) includes a server-side TIFF image parser used during file uploads and URL preview rendering. The TIFF format uses Image File Directory (IFD) structures with offset fields that point to data locations within the file. The vulnerability (CWE-400: Uncontrolled Resource Consumption) arises because Mattermost does not validate the IFD offset value from the TIFF image header before using it to drive memory allocation. An attacker can craft a TIFF file with a maliciously large or nonsensical IFD offset, causing the server to attempt an enormous heap allocation, exhausting available RAM and triggering an OOM condition that crashes or severely degrades the server process. This class of vulnerability is common in image-processing libraries that parse attacker-controlled binary formats without bounds-checking header fields prior to resource allocation.
RemediationAI
The primary remediation is to upgrade Mattermost server to a fixed version per the vendor security advisory at https://mattermost.com/security-updates (MMSA-2026-00648). Exact patched version numbers are not independently confirmed from the available input data - consult the advisory page directly to identify the minimum safe release for your branch (10.11.x, 11.4.x, 11.5.x, or 11.6.x). As a compensating control while patching is coordinated, administrators can restrict file upload and URL-preview permissions to a reduced set of trusted users or roles within Mattermost's System Console, which reduces the attack surface at the cost of feature availability for general users. Disabling TIFF-format support at the reverse proxy or application layer (if configurable) would eliminate the vulnerable code path entirely, though this may break legitimate workflows involving TIFF files. Rate-limiting file upload API endpoints can reduce the impact of repeated exploitation attempts but will not prevent a single well-crafted request from consuming excessive memory.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today