Technical impact
Mattermost versions that fail to validate the length of a Zoom chat line before slicing allow an authenticated attacker to force the Agents plugin to crash. The flaw occurs during the summarization of a Zoom chat transcription that contains short continuation lines, resulting in a denial of service to the plugin rather than arbitrary code execution. The vulnerability does not provide an easy path for elevation or persistence beyond causing a crash, but it can bring down a plugin that may be critical for chat analysis or compliance monitoring.
Affected Systems
The affected product is Mattermost. Versions up to and including 11.9, as well as specific releases 11.1.9, 11.5.8, and 11.10.7.0, are impacted. The vendor recommends upgrading to 11.10.0, 11.9.2, 11.8.6, 11.7.11, or any newer version that includes the fix.
Risk and Exploitability
The CVSS score of 6.5 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploit activity so far. The attack requires authenticated access to Mattermost, which limits exposure to users with at least basic account privileges. The most likely vector is a legitimate user who can insert or edit Zoom chat transcriptions in a channel. Once the flaw is triggered, the Agents plugin will crash, causing service disruption but no compromise of data or system state.
