CVE-2026-8075

Analyzed Analyzed - Analysis Complete

Mattermost Desktop App Link Header Null Check Failure

Publication date: 2026-07-17

Last updated on: 2026-07-30

Assigner: Mattermost, Inc.

Description

Mattermost Desktop App versions <=6.2 5.5.13 6.0.2.0 fail to properly null check when checking for headers in the Mattermost Desktop App which allows any user to crash another channel members Desktop App via posting a malicious link with an embedded image that misses one of those headers. Mattermost Advisory ID: MMSA-2026-00668

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-17

Last Modified

2026-07-30

Generated

2026-08-06

AI Q&A

2026-07-17

EPSS Evaluated

2026-08-04

NVD

CVE-2026-8075

EUVD

EUVD-2026-45157

Affected Vendors & Products

Vendor	Product	Version / Range
mattermost	mattermost_desktop	From 5.5.13 (inc) to 5.13.6 (exc)
mattermost	mattermost_desktop	From 6.0.2 (inc) to 6.2.1 (exc)
mattermost	mattermost_desktop	From 6.2.1 (exc) to 6.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-754	The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

Executive Summary

Mattermost Desktop App versions <=6.2, 5.5.13, and 6.0.2.0 fail to properly null check headers when processing embedded images in links. This allows a user to crash another user's desktop app by posting a malicious link with an image missing required headers.

Detection Guidance

This vulnerability can be detected by checking the installed version of Mattermost Desktop App. If the version is <=6.2, <=5.5.13, or <=6.0.2.0, the system is vulnerable. Use commands like 'mattermost-desktop --version' or check installed packages via package managers (e.g., 'apt list --installed | grep mattermost' or 'brew list mattermost-desktop').

Monitor for crashes in the Mattermost Desktop App after users interact with links containing embedded images. Check application logs for errors related to missing headers in images.

Impact Analysis

This vulnerability can cause denial-of-service by crashing the desktop app of any user who views the malicious link. It does not allow data theft or code execution but disrupts normal app functionality.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves a denial-of-service condition in the Mattermost Desktop App. However, if the application is used to process or store sensitive data under these regulations, a crash could disrupt access to such data, potentially impacting availability requirements.

Mitigation Strategies

Update Mattermost Desktop App to versions 6.2.5.5.13, 6.0.2.0 or later to address the vulnerability. Monitor Mattermost's security updates page for patches and apply them promptly.

Hi! I’m here to help you understand CVE-2026-8075. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70