CVE-2026-8075

MediumCVSS 6.5/10Last modified Oct 15, 2026

Description

Mattermost Desktop App versions <=6.2 5.5.13 6.0.2.0 fail to properly null check when checking for headers in the Mattermost Desktop App which allows any user to crash another channel members Desktop App via posting a malicious link with an embedded image that misses one of those headers. Mattermost Advisory ID: MMSA-2026-00668

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-754

Affected software

No affected versions have been published.

Timeline

Published
Jul 17, 2026
Last modified
Oct 15, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-807508.4In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after of_node_put() scpsys_get_CVE-2026-807517.8In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() mtkCVE-2026-807528.4In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpad_spi_suspend() reCVE-2026-807538.4In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue ovpn queues severaCVE-2026-807547.8In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55 transmitter electrode count typo DurinCVE-2026-80755In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission value exceeding the class permission countCVE-2026-80756In the Linux kernel, the following vulnerability has been resolved: selinux: do not cancel a policy conversion that never started sel_writCVE-2026-80757In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common seCVE-2026-80758In the Linux kernel, the following vulnerability has been resolved: futex: Avoid private hash use-after-free on final put futex_private_haCVE-2026-80759In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_aml: validate firmware segment lengths aml_download_firCVE-2026-80769.3Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform allows the use of numeric PINs for user CVE-2026-80760In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 mgmt_hci_cmd
CVE-2026-8075: Medium severity, CVSS 6.5 | Vulnix