CVE-2026-15814

Name of the Vulnerable Software and Affected Versions Mattermost version 11.9.0 Mattermost version 11.8.4 Mattermost version 11.7.7 Mattermost version 10.11.22

Description An issue exists where the system fails to limit the amount of memory allocated during the decoding of uploaded image files. An authenticated user can exploit this by uploading a specially crafted image as a profile picture, channel file attachment, team icon, or custom brand image, leading to excessive server memory consumption and a potential denial of service.

Recommendations Update Mattermost version 11.9.0 to a newer version. Update Mattermost version 11.8.4 to a newer version. Update Mattermost version 11.7.7 to a newer version. Update Mattermost version 10.11.22 to a newer version.