CVE-2026-116516 - Vulnerability Details - OpenCVE

Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Mattermost	Mattermost

No data.

No data.

References

Link	Providers
https://mattermost.com/security-updates

History

Mon, 26 Oct 2026 17:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mattermost Mattermost mattermost
Vendors & Products		Mattermost Mattermost mattermost

Mon, 26 Oct 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 26 Oct 2026 14:00:00 +0000

Type	Values Removed	Values Added
Description		Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723
Title		Insufficient length validation when parsing Zoom chat transcriptions
Weaknesses		CWE-754
References		https://mattermost.com/security-updates
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Mattermost

Published: 2026-10-26T13:56:57.973Z

Updated: 2026-10-26T15:35:50.283Z

Reserved: 2026-10-26T13:52:45.402Z

Link: CVE-2026-116516

Vulnrichment

Updated: 2026-10-26T15:32:07.536Z

NVD

Status : Awaiting Analysis

Published: 2026-10-26T14:16:37.813

Modified: 2026-10-26T16:50:49.857

Link: CVE-2026-116516

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116516", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2026-10-26T13:52:45.402Z", "datePublished": "2026-10-26T13:56:57.973Z", "dateUpdated": "2026-10-26T15:35:50.283Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "<=11.9 11.1.9 11.5.8 11.10.7.0", "status": "affected", "version": "<=11.9 11.1.9 11.5.8 11.10.7.0", "versionType": "semver"}, {"version": "11.10.0", "status": "unaffected"}, {"version": "11.9.2", "status": "unaffected"}, {"version": "11.8.6", "status": "unaffected"}, {"version": "11.7.11", "status": "unaffected"}]}], "credits": [{"lang": "en", "type": "finder", "value": "alimursaliyev"}], "descriptions": [{"lang": "en", "value": "Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723"}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseSeverity": "MEDIUM", "baseScore": 6.5}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions", "cweId": "CWE-754"}]}], "references": [{"url": "https://mattermost.com/security-updates", "name": "MMSA-2026-00723", "tags": ["vendor-advisory"]}], "solutions": [{"value": "Update Mattermost to versions 11.10.0, 11.9.2, 11.8.6, 11.7.11 or higher.", "lang": "en"}], "source": {"advisory": "MMSA-2026-00723", "defect": ["https://mattermost.atlassian.net/browse/MM-69780"], "discovery": "EXTERNAL"}, "title": "Insufficient length validation when parsing Zoom chat transcriptions", "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2026-10-26T13:56:57.973Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116516", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-26T14:54:35.705341Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T15:35:50.283Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116516", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-26T14:54:35.705341Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T15:32:07.536Z"}}], "cna": {"title": "Insufficient length validation when parsing Zoom chat transcriptions", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-69780"], "advisory": "MMSA-2026-00723", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "alimursaliyev"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "<=11.9 11.1.9 11.5.8 11.10.7.0", "versionType": "semver", "lessThanOrEqual": "<=11.9 11.1.9 11.5.8 11.10.7.0"}, {"status": "unaffected", "version": "11.10.0"}, {"status": "unaffected", "version": "11.9.2"}, {"status": "unaffected", "version": "11.8.6"}, {"status": "unaffected", "version": "11.7.11"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost to versions 11.10.0, 11.9.2, 11.8.6, 11.7.11 or higher."}], "references": [{"url": "https://mattermost.com/security-updates", "name": "MMSA-2026-00723", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-754", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2026-10-26T13:56:57.973Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116516", "state": "PUBLISHED", "dateUpdated": "2026-10-26T15:35:50.283Z", "dateReserved": "2026-10-26T13:52:45.402Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2026-10-26T13:56:57.973Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.2"}