Mattermost versions 11.3.x (≤11.3.0), 11.2.x (≤11.2.2), and 10.11.x (≤10.11.10) do not bound memory allocation when processing PSD image files. This weakness, identified as CWE‑789, allows an authenticated attacker to upload a specially crafted PSD file that causes the server to allocate more memory than intended, exhausting system memory and resulting in a denial of service.

The affected product is Mattermost Server. The vulnerable releases are 11.3.x up to 11.3.0, 11.2.x up to 11.2.2, and 10.11.x up to 10.11.10. Official fixes are delivered to 11.4.0, 11.3.1, 11.2.3, 10.11.11, and later versions.

The CVSS score of 4.3 indicates moderate severity, while an EPSS score of less than 1% suggests a low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authentication with upload privileges, it is most likely to be exploited by internal users or actors who can join the system. Exploitation results in server memory exhaustion and a temporary denial of service; full system compromise is not indicated in the description.