Mastodon EUVD-2026-39060

Exploitation requires that the target run an unpatched Mastodon (below 4.5.11 / 4.4.18 / 4.3.24) and that the malformed <math>/MathML content reach a service that invokes the math sanitizer - which occurs through normal federated or user-submitted content paths, so no special non-default feature toggle is needed. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required, and exploitation works against default configurations of network-reachable instances. The main limiting factors are reachability and federation posture: the impact scope ('whole server' vs. 'targeted users services') depends on which action/service ingests the malformed node, and an instance that does not federate with or accept content from the attacker materially reduces exposure.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) is internally consistent with a remotely reachable, no-authentication, no-interaction availability attack and accurately reflects the federated, network-exposed nature of Mastodon. No EPSS score, SSVC decision, KEV listing, or POC was provided, so real-world exploitation pressure is currently unquantified; the exploitation status is 'no public exploit identified at time of analysis.' One data conflict must be flagged: the input Tags label this 'Information Disclosure,' but the CVSS vector sets C:N/I:N and only A:H, and the description explicitly characterizes it as a DoS - the tag appears to be mislabeled and should not be treated as a confidentiality issue. Net assessment: a genuine, easily reachable availability risk for any instance that federates with untrusted servers, but not a confidentiality/integrity threat and not (yet) known to be actively exploited.

An attacker operating or controlling any federating ActivityPub instance posts or sends content containing a deliberately malformed <math> node, then directs it at a victim Mastodon server or a specific user on it. When the victim server's sanitizer processes the node, the uncaught exception crashes the handling service, denying service to the targeted user or the whole instance. No public POC has been identified, but the attack requires no authentication, no user interaction, and only low complexity per the CVSS vector.