Vulnerability Details CVE-2026-15814
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a specially crafted image as a profile picture, channel file attachment, team icon, or custom brand image. Mattermost Advisory ID: MMSA-2026-00719
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 13.2%
CVSS Severity
CVSS v3 Score 6.5
References
Products affected by CVE-2026-15814
-
cpe:2.3:a:mattermost:mattermost_server:10.11.0
-
cpe:2.3:a:mattermost:mattermost_server:10.11.1
-
cpe:2.3:a:mattermost:mattermost_server:10.11.10
-
cpe:2.3:a:mattermost:mattermost_server:10.11.11
-
cpe:2.3:a:mattermost:mattermost_server:10.11.12
-
cpe:2.3:a:mattermost:mattermost_server:10.11.13
-
cpe:2.3:a:mattermost:mattermost_server:10.11.14
-
cpe:2.3:a:mattermost:mattermost_server:10.11.15
-
cpe:2.3:a:mattermost:mattermost_server:10.11.16
-
cpe:2.3:a:mattermost:mattermost_server:10.11.17
-
cpe:2.3:a:mattermost:mattermost_server:10.11.18
-
cpe:2.3:a:mattermost:mattermost_server:10.11.19
-
cpe:2.3:a:mattermost:mattermost_server:10.11.2
-
cpe:2.3:a:mattermost:mattermost_server:10.11.20
-
cpe:2.3:a:mattermost:mattermost_server:10.11.21
-
cpe:2.3:a:mattermost:mattermost_server:10.11.22
-
cpe:2.3:a:mattermost:mattermost_server:10.11.3
-
cpe:2.3:a:mattermost:mattermost_server:10.11.4
-
cpe:2.3:a:mattermost:mattermost_server:10.11.5
-
cpe:2.3:a:mattermost:mattermost_server:10.11.6
-
cpe:2.3:a:mattermost:mattermost_server:10.11.7
-
cpe:2.3:a:mattermost:mattermost_server:10.11.8
-
cpe:2.3:a:mattermost:mattermost_server:10.11.9
-
cpe:2.3:a:mattermost:mattermost_server:11.7.0
-
cpe:2.3:a:mattermost:mattermost_server:11.7.1
-
cpe:2.3:a:mattermost:mattermost_server:11.7.2
-
cpe:2.3:a:mattermost:mattermost_server:11.7.3
-
cpe:2.3:a:mattermost:mattermost_server:11.7.4
-
cpe:2.3:a:mattermost:mattermost_server:11.7.5
-
cpe:2.3:a:mattermost:mattermost_server:11.7.6
-
cpe:2.3:a:mattermost:mattermost_server:11.7.7
-
cpe:2.3:a:mattermost:mattermost_server:11.8.0
-
cpe:2.3:a:mattermost:mattermost_server:11.8.1
-
cpe:2.3:a:mattermost:mattermost_server:11.8.2
-
cpe:2.3:a:mattermost:mattermost_server:11.8.3
-
cpe:2.3:a:mattermost:mattermost_server:11.8.4