What is the CVSS score of CVE-2026-8075?

CVE-2026-8075 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Mattermost Desktop App CVE-2026-8075

EUVD-2026-45157 MEDIUM

Improper Check for Unusual or Exceptional Conditions (CWE-754)

2026-07-17 Mattermost

GHSA-rm64-886x-w6qc

Denial Of Service Mattermost

6.5

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-delivered via posted link (AV:N), trivial complexity (AC:L), requires only a valid account to post (PR:L), auto-triggered on render (UI:N), client crash only with no data exposure (C:N/I:N/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 10:45 vuln.today

DescriptionCVE.org

Mattermost Desktop App versions <=6.2 5.5.13 6.0.2.0 fail to properly null check when checking for headers in the Mattermost Desktop App which allows any user to crash another channel members Desktop App via posting a malicious link with an embedded image that misses one of those headers. Mattermost Advisory ID: MMSA-2026-00668

AnalysisAI

Improper null checking in Mattermost Desktop App versions ≤6.2, 5.5.13, and 6.0.2.0 enables any authenticated channel member to crash the Desktop App of all other members in the same channel by posting a crafted link containing an embedded image served without expected HTTP headers. The crash is client-side and can be made persistent if the malicious message remains in the channel, forcing repeated crashes each time an affected client reconnects. No public exploit has been identified at time of analysis, but the low-privilege attack vector and trivial reproduction make this a realistic insider or compromised-account threat in collaborative environments.

Technical ContextAI

The root cause is CWE-754 (Improper Check for Unusual or Exceptional Conditions): the Desktop App's link-preview rendering code reads specific HTTP response headers when processing embedded images, but fails to null-check before dereferencing those header values. When a server omits one or more of these expected headers, the application encounters a null or undefined reference and crashes rather than handling the missing value gracefully. The flaw is confined to the Electron-based Desktop App client (CPE: cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*) and is triggered during the automatic rendering of link previews, a default behavior in Mattermost channels. Web and mobile clients are not described as affected by this specific null-check path.

RemediationAI

Upgrade the Mattermost Desktop App to a version beyond the affected ceiling per the vendor security advisory at https://mattermost.com/security-updates. Exact patched release version numbers are not specified in the available intelligence data and must be confirmed directly from that advisory before deployment. As a compensating control, channel administrators can restrict posting permissions in high-sensitivity channels to trusted users only, reducing the attacker pool. Server-side message moderation or link-preview disabling (if configurable at the server level) would also limit exposure, though this affects all users. There is no server-side filtering that can reliably prevent a crafted missing-header image response from triggering the client-side null dereference once a malicious link is posted.