Mattermost EUVD-2026-109938

Requires an authenticated account (CVSS PR:L) on a Mattermost server and the ability to upload a PDF file that the server then processes for text extraction. The specific trigger is a crafted PDF whose compressed content stream expands into a very large amount of extracted text, and the flaw is the absence of any bound on the volume of that extracted text. Limiting factors: exploitation is not possible unauthenticated, depends on the server performing PDF text extraction on uploaded files, and impact is confined to availability (memory exhaustion / DoS) with no confidentiality or integrity effect. Affected deployments are Mattermost 11.7.x ≤ 11.7.10, 11.8.x ≤ 11.8.5, 11.9.x ≤ 11.9.1, and 11.10.x ≤ 11.10.1; upgrading to a fixed release is the remediation per the vendor advisory.

This is a moderate-severity availability issue (vendor CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and the independent signals broadly agree it is a priority to schedule rather than an emergency. The CVSS vector indicates network-reachable, low-complexity exploitation but requires authentication (PR:L), and impact is confined to availability only (C:N/I:N/A:H) - consistent with CWE-409 (improper handling of highly compressed data) and the description of memory exhaustion. vuln.today assigns a 'this_month' decision label, consistent with a real but non-critical DoS. This CVE is NOT in CISA KEV and no EPSS score was supplied; exploitation status is therefore 'no public exploit identified at time of analysis.' The only reference is the vendor advisory landing page (mattermost.com/security-updates), not a working exploit. Net assessment: a credible, easy-to-trigger DoS for any environment where untrusted-but-authenticated users can upload PDFs, but the authentication requirement and availability-only impact keep it below the tier reserved for unauthenticated RCE or actively-exploited flaws. Missing data to note: no EPSS, no KEV, and no explicit fixed-version list was provided - only the affected-version ceilings.

An authenticated Mattermost user (or a compromised/low-privilege account) uploads a specially crafted PDF whose compressed content stream decompresses into an extremely large volume of text. When the server extracts that text without bounding its volume, memory consumption spikes and exhausts available server memory, degrading or taking down the Mattermost instance for all users. No public exploit code or PoC is identified at time of analysis.