CVE-2026-9602: 
Mattermost Desktop App vulnerability analysis and mitigation

CVE-2026-9602 is a Denial of Service vulnerability in the Mattermost Desktop App caused by insufficient payload validation between the Mattermost Web App and Desktop App. A malicious server owner can crash the Desktop App by sending a malformed method payload. Affected versions include Mattermost Desktop App ≤6.0.2, ≤5.6.13, and versions between 6.0.2 and 6.2.1 (exclusive). It was published on July 17, 2026, with Mattermost Advisory ID MMSA-2026-00678. The CVSS v3.1 base score is 6.5 (Medium) (GitHub Advisory, Mattermost Security).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption), stemming from a failure to validate payloads received by the Mattermost Desktop App from the Mattermost Web App. An attacker who controls a Mattermost server can modify the payload of a method call to a malformed structure, which the Desktop App processes without adequate validation, triggering an application crash. Exploitation requires low privileges (server owner/administrator access) and no user interaction beyond the victim connecting to the malicious server. No public proof-of-concept code has been identified (GitHub Advisory, Mattermost Security).

Successful exploitation results in a crash of the Mattermost Desktop App on the victim's machine, causing a Denial of Service (DoS) with high availability impact. There is no confidentiality or integrity impact — the vulnerability cannot be used to access or modify data. The attack is limited in scope to the affected Desktop App instance and does not enable lateral movement or data exfiltration (GitHub Advisory).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code as of the disclosure date. The EPSS score is approximately 0.235%, indicating a low probability of exploitation within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to control a Mattermost server that the victim connects to, limiting the attack surface to scenarios where users connect to untrusted or compromised servers (GitHub Advisory).

1. Setup malicious server: The attacker operates or compromises a Mattermost server instance that target users connect to with the Desktop App.
2. Identify target: Confirm that connecting users are running a vulnerable version of the Mattermost Desktop App (≤6.0.2, ≤5.6.13, or between 6.0.2 and 6.2.1).
3. Craft malformed payload: Modify the server-side response payload for a method call sent from the Web App to the Desktop App, replacing the expected structure with a malformed one that bypasses client-side expectations.
4. Trigger crash: When the victim's Desktop App processes the malformed payload, it fails to handle the unexpected input, resulting in an application crash and denial of service (GitHub Advisory).

• Logs: Repeated unexpected crashes or unhandled exception logs in the Mattermost Desktop App log files, particularly following connection to a specific server.
• Process: Mattermost Desktop App process terminating unexpectedly without user-initiated action, potentially with crash dump files generated by the OS.
• Network: Desktop App connections to unfamiliar or newly configured Mattermost server endpoints prior to crash events.

Users should upgrade the Mattermost Desktop App to version 6.3.0, 6.2.1, or 5.13.7 (or later), which contain fixes for this vulnerability. As a workaround, organizations should restrict users from connecting to untrusted or unverified Mattermost server instances, and implement network controls to limit exposure to potentially malicious servers. Monitoring for unexpected Desktop App crashes can help detect exploitation attempts (Mattermost Security, GitHub Advisory).