Executive brief
Mattermost is a collaboration platform used for team communication and file sharing. A vulnerability in how the server processes image files could allow a registered user to crash the service by uploading a specially crafted TIFF image. This results in a denial-of-service (DoS) condition, making the platform unavailable for all users until the server is restarted.
Technical details
Mattermost Server fails to properly validate the TIFF Image File Directory (IFD) offset in image headers before allocating memory. An authenticated attacker with file upload or URL posting permissions can exploit this by uploading a malicious TIFF file or posting a link to one, triggering an Out-of-Memory (OOM) condition on the server. This is classified as CWE-400 (Uncontrolled Resource Consumption). The issue is resolved in versions 10.11.15, 11.4.5, 11.5.4, 11.6.1, and 11.7.0.
Affected products
- Mattermost Mattermost Server 10.11.0 to 10.11.14, 11.4.0 to 11.4.4, 11.5.0 to 11.5.3, 11.6.0
Timeline
- 2026-05-22: disclosed: Initial advisory publication
- 2026-05-22: advisory: Mattermost Advisory MMSA-2026-00648 released