CVE-2026-26246: Mattermost fails to bound memory allocation when processing PSD image files

March 16, 2026 (updated April 27, 2026)

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing PSD image files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted PSD file. Mattermost Advisory ID: MMSA-2026-00572

References

github.com/advisories/GHSA-44mv-jq72-gj49
github.com/mattermost/mattermost
github.com/mattermost/mattermost/commit/38b413a27604e8721fbe008f8ec4b4e6c47ad4f0
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-26246

Code Behaviors & Features

Detect and mitigate CVE-2026-26246 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →