PT-2026-42751 · Mattermost · Mattermost

Zephrfish · Published 2026-05-22 · Updated 2026-07-07 · CVE-2026-5755

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Mattermost version 11.6.0 Mattermost version 11.5.3 Mattermost version 11.4.4 Mattermost version 10.11.14

Description Authenticated users with file upload or posting permissions can cause a denial of service resulting in server Out of Memory (OOM) by uploading a crafted TIFF file or posting a URL that serves one. This occurs because the software fails to validate the TIFF IFD (Image File Directory) offset in the image header before allocating memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2026-07543

CVE-2026-5755

GHSA-37J2-3VV8-CF24

GO-2026-5835

Affected Products

Mattermost

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5755.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5755 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-5755 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07543 · Security Note
• https://osv.dev/vulnerability/GO-2026-5835 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-37j2-3vv8-cf24 · Vendor Advisory
• https://github.com/mattermost/mattermost/commit/d37c2d9d50b50963dabd92153adf7ed52016769a · Note
• https://github.com/mattermost/mattermost · Note
• https://github.com/advisories/GHSA-37j2-3vv8-cf24 · Note
• https://t.me/CVEtracker/54620 · Telegram Post
• https://vuldb.com/vuln/365183 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5755 · Note