CVE Feed

    Dashboard / CVE / CVE-2025-1558

    CVE-2025-1558

    Mattermost Mobile Apps versions <=2.25.0 fail to properly validate GIF images prior to rendering which allows a malicious user to cause the Android application to crash via message containing a maliciously crafted GIF.

    Published:Mar 24, 2025
    Last Modified:Sep 25, 2025
    EPS:Mar 24, 2025
    EPSS Score:0.00103
    CVSS Score:6.5

    Affected Products

    Vendor
    Mattermost
    Product
    Mattermost Mobile

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-59480 (CVSS 6.1) — Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted se…
    CVE-2025-30516 (CVSS 2) — Mattermost Mobile Apps versions <=2.25.0  fail to terminate sessions during logout under certain conditions (e…
    CVE-2025-20630 (CVSS 6.5) — Mattermost Mobile versions <=2.22.0 fail to properly handle posts with attachments containing fields that cann…
    CVE-2025-20072 (CVSS 6.5) — Mattermost Mobile versions <= 2.22.0 fail to properly validate the style of proto supplied to an action's styl…
    CVE-2025-0476 (CVSS 4.3) — Mattermost Mobile Apps versions <=2.22.0 fail to properly handle specially crafted attachment names, which all…
    CVE-2025-21083 (CVSS 6.5) — Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authent…
    CVE-2025-20036 (CVSS 6.5) — Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authent…
    CVE-2024-11358 (CVSS 5.7) — Mattermost Android Mobile Apps versions <=2.21.0 fail to properly configure file providers which allows an att…
    CVE-2024-45833 (CVSS 4.5) — Mattermost Mobile Apps versions <=2.18.0 fail to disable autocomplete during login while typing the password a…
    CVE-2024-39767 (CVSS 4.2) — Mattermost Mobile Apps versions <=2.16.0 fail to validate that the push notifications received for a server ac…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High