Mattermost processes TIFF files without validating the IFD offset, enabling an authenticated attacker to trigger a server out‑of‑memory condition using a malformed file or an external URL. The flaw can be exercised by any user with file upload or message posting permissions and results in a denial of service by exhausting memory until the service becomes unresponsive. This is a classic example of unchecked resource allocation (CWE‑400).

The issue affects Mattermost releases 11.6.x up through 11.6.0, 11.5.x up through 11.5.2 and 11.5.3, 11.4.x up through 11.4.4, and 10.11.x up through 10.11.14. All these are mitigated by upgrading to at least Mattermost version 11.7.0, 11.6.1, 11.5.4, 11.4.5, or 10.11.15 or newer for each respective major version.

With a CVSS score of 6.5, this vulnerability is considered medium severity. No EPSS data is available and the issue is not listed in CISA’s KEV catalogue, suggesting that widespread exploitation has not been observed. An attacker must be authenticated and possess either file upload or posting rights, implying the exploitation vector is likely internal or from a compromised account. Once the crafted TIFF is processed, the server allocates large amounts of memory and eventually exhausts available RAM, leading to a denial of service. The lack of public exploits and low EPSS leave the risk moderate but still actionable.