This vulnerability arises when Mattermost fails to bind the volume of text extracted from an uploaded PDF, allowing an authenticated user to supply a crafted PDF whose compressed content stream expands into a very large amount of text. The unbounded memory consumption can exhaust server memory, resulting in a denial of service. The weakness is classified as CWE-409, indicating improper restriction of operations within a finite domain.

Affected vendors include Mattermost. Vulnerable releases are Mattermost 11.9.x through 11.9.1, 11.8.x through 11.8.5, 11.7.x through 11.7.10, and 11.10.x through 11.10.1. All these versions lack the necessary limits on extracted text volume. Updating to 11.11.0, 11.9.2, 11.8.6, 11.7.11, or 11.10.2 or later resolves the issue.

The CVSS score of 6.5 indicates a moderate but potentially significant impact. EPSS is not available, and the vulnerability is not currently listed in CISA KEV, suggesting no widespread exploitation has been reported. However, the attack requires an authenticated user who can upload PDFs, and so the risk remains notable for internal users with file upload permissions. The exploit path is straightforward: a malicious PDF is uploaded to the Mattermost server, the server extracts text without bounding the output, memory is exhausted, and the service becomes unresponsive.