Executive brief
Mattermost Server, a team communication platform, fails to limit memory usage when processing uploaded image files. An authenticated user can upload a maliciously crafted image as a profile picture, channel attachment, team icon, or brand image to cause the server to consume excessive memory, resulting in a denial of service that disrupts availability for all users.
Technical details
Mattermost Server contains a resource exhaustion vulnerability in its image decoding logic, where the application fails to implement memory allocation limits during image file processing. The vulnerability is triggered when an authenticated attacker uploads a specially crafted image file to the server. Attack vectors include profile picture uploads, channel file attachments, team icons, and custom brand images. Successful exploitation leads to excessive memory consumption on the server, potentially causing a denial of service condition. Patches are available in Mattermost Server versions 11.9.1+, 11.8.5+, 11.7.8+, and 10.11.23+.
Affected products
- Mattermost Server 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22
Timeline
- 2026-09-14: disclosed: CVE-2026-15814 publicly disclosed