Riskcovery

CVE-2026-9602

Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods

State
Published
Severity
5.7 Medium
Published
Jul 17, 2026
Updated
Jul 17, 2026
Reserved
May 26, 2026

Read the record on cve.org

Description

Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App which allows a malicious server owner to crash the Mattermost Desktop App via changing the payload of a method to a malformed one. Mattermost Advisory ID: MMSA-2026-00678

Scores

CVSSScoreVectorSource
3.15.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HMattermost

Weaknesses

  • CWE-400 Uncontrolled Resource Consumption

Affected Products

ProductVersions
MattermostMattermost
  • 6.0.2 and earlierAffected
  • 5.6.13 and earlierAffected
  • 6.3.0Not affected
  • 6.2.1.0Not affected
  • 5.13.7.0Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.