CVE-2026-15814

published 2026-09-14

CVE-2026-15814: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding…

Priority P3 35 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C N I N A H

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a specially crafted image as a profile picture, channel file attachment, team icon, or custom brand image. Mattermost Advisory ID: MMSA-2026-00719

Affected

8 ranges

Vendor	Product	Version range	Fixed in
mattermost	mattermost	10.11.0 – 10.11.22	—
mattermost	mattermost	11.7.0 – 11.7.7	—
mattermost	mattermost	11.8.0 – 11.8.4	—
mattermost	mattermost	11.9.0 – 11.9.0	—
mattermost	mattermost_server	>= 10.11.0 < 10.11.23	10.11.23
mattermost	mattermost_server	>= 11.7.0 < 11.7.8	11.7.8
mattermost	mattermost_server	>= 11.8.0 < 11.8.5	11.8.5
mattermost	mattermost_server	>= 11.9.0 < 11.9.1	11.9.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-409