---
id: CVE-2026-116516
title: Insufficient length validation when parsing Zoom chat transcriptions
summary: >-
  Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat
  line length before slicing which allows an authenticated attacker to crash the
  Agents plugin via summarizing a Zoom chat transcription containing short
  continu…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-754
vendor: Mattermost
product: Mattermost
affected:
  - >-
    Mattermost >= <=11.9 11.1.9 11.5.8 11.10.7.0 <= <=11.9 11.1.9 11.5.8
    11.10.7.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-26T14:54:35.705341Z'
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T15:35:50.283Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116516'
references:
  - url: 'https://mattermost.com/security-updates'
    label: MMSA-2026-00723
tags:
  - cve.org
ingestedAt: '2026-10-26T14:27:31.809Z'
---

## Overview

Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723

## Affected

- `Mattermost >= <=11.9 11.1.9 11.5.8 11.10.7.0 <= <=11.9 11.1.9 11.5.8 11.10.7.0`

## Remediation

Update Mattermost to versions 11.10.0, 11.9.2, 11.8.6, 11.7.11 or higher.