Is CVE-2026-15814 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-15814?

CVE-2026-15814 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-15814

Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a specially crafted image as a profile picture, channel file attachment, team icon, or custom brand image. Mattermost Advisory ID: MMSA-2026-00719