CVE-2026-5755: Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory

May 26, 2026 (updated June 29, 2026)

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.2, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the TIFF IFD offset in the image header before allocating memory, which allows authenticated users with file upload or posting permissions to cause a denial of service (server OOM) via uploading a crafted TIFF file or posting a URL that serves one.. Mattermost Advisory ID: MMSA-2026-00648

References

github.com/advisories/GHSA-37j2-3vv8-cf24
github.com/mattermost/mattermost/commit/d37c2d9d50b50963dabd92153adf7ed52016769a
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-5755

Code Behaviors & Features

Detect and mitigate CVE-2026-5755 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →