CVE-2026-8075 Posting a malicious markdown image crashes the Mattermost Desktop App

Q: Is CVE-2026-8075 being exploited?

There is no known exploitation of CVE-2026-8075 in the wild and no public exploit code.

Q: How do I fix CVE-2026-8075?

No fix has been published for CVE-2026-8075 yet. Limit exposure of the affected software until one is available.

Medium 6.5 Published 17 Jul 2026 Updated 17 Jul 2026

An attacker can crash a victim's Mattermost Desktop App by posting a malicious markdown image with missing headers, causing a null dereference.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-8075?

CVE-2026-8075 is a medium-severity vulnerability in Mattermost, published on 17 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Mattermost Desktop App versions <=6.2 5.5.13 6.0.2.0 fail to properly null check when checking for headers in the Mattermost Desktop App which allows any user to crash another channel members Desktop App via posting a malicious link with an embedded image that misses one of those headers. Mattermost Advisory ID: MMSA-2026-00668

Weakness: CWE-754

Which versions are affected by CVE-2026-8075?

It affects 1 product.

Products include Mattermost Mattermost Desktop.

How do I fix CVE-2026-8075?

No fix has been published for CVE-2026-8075 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-8075 being exploited?

There is no known exploitation of CVE-2026-8075 in the wild and no public exploit code.

Sources

Also known as GHSA-rm64-886x-w6qc.