CVE-2026-26246: Memory Exhaustion via Malformed PSD File Upload

Q: What is the severity of CVE-2026-26246?

CVE-2026-26246 has a severity level that may lead to denial of service due to memory exhaustion.

Q: How do I fix CVE-2026-26246?

To fix CVE-2026-26246, upgrade to Mattermost versions higher than 11.3.0, 11.2.2, or 10.11.10.

Q: Who is affected by CVE-2026-26246?

CVE-2026-26246 affects Mattermost versions 11.3.0, 11.2.2, and 10.11.10.

Q: What can an attacker do with CVE-2026-26246?

An attacker can exploit CVE-2026-26246 to upload malformed PSD files, causing server memory exhaustion.

Q: Is CVE-2026-26246 a remote or local attack?

CVE-2026-26246 requires authentication, making it a local attack that can be exploited by authenticated users.

Published Mar 16, 2026

Updated

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing PSD image files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted PSD file. Mattermost Advisory ID: MMSA-2026-00572

Affected Software

4 affected components

Mattermost Mattermost<=11.3.0, <=11.2.2, <=10.11.10

Mattermost Mattermost Server>=10.11.0<10.11.11

Mattermost Mattermost Server>=11.2.0<11.2.3

Mattermost Mattermost Server>=11.3.0<11.3.1

Remediation

Information

Update Mattermost to versions 11.4.0, 11.3.1, 11.2.3, 10.11.11 or higher.

Event History

Mar 16, 2026

CVE Published

via MITRE·11:33 AM

Data Sourced

via MITRE·11:33 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-26246?

CVE-2026-26246 has a severity level that may lead to denial of service due to memory exhaustion.

How do I fix CVE-2026-26246?