Executive brief
Mattermost is a collaboration and messaging platform used by organizations for internal communication. A vulnerability in the Mattermost Desktop App allows a user to crash the application of other members in a channel by posting a specially crafted link containing a malicious image. This can lead to service disruptions and prevent team members from accessing their communications until the application is restarted.
Technical details
The Mattermost Desktop App suffers from an improper check for unusual or exceptional conditions (CWE-754) specifically related to a missing null check during header validation. An authenticated attacker can exploit this by posting a malicious link with an embedded image that lacks specific expected headers. When other channel members' desktop clients attempt to process the image, the lack of a null check causes the application to crash. This is a remote denial-of-service attack requiring low privileges (standard user account) and no user interaction beyond the client attempting to render the malicious post. Fixes are available in versions 6.3.0, 5.13.6.0, and 6.2.1.0.
Affected products
- Mattermost Mattermost Desktop App <=6.2, 5.5.13, 6.0.2.0
Timeline
- 2026-07-17: advisory: Mattermost Advisory MMSA-2026-00668 published.
- 2026-07-17: disclosed: CVE-2026-8075 published to the NVD.