---
id: "CVE-2026-116516"
kind: "vulnerability"
aliases: ["CVE-2026-116516"]
title: "Mattermost: Zoom chat parsing flaw lets a user crash the Agents plugin"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["agents-plugin", "mattermost", "package", "self-hosted", "zoom"]
not_affected_if: ["no-agents-plugin", "no-zoom-integration"]
published_at: "2026-10-26T14:16:37+00:00"
first_seen_at: "2026-10-26T14:30:37+00:00"
updated_at: "2026-10-26T14:32:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116516", "first_seen_at": "2026-10-26T14:30:37+00:00"}]
---

# Mattermost: Zoom chat parsing flaw lets a user crash the Agents plugin

Mattermost versions up to 11.9 and several 11.x builds fail to check the length of Zoom chat lines before slicing them. An authenticated user who summarizes a Zoom chat transcription with short continuation lines can crash the Agents plugin.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Mattermost server version against the affected list (<=11.9, 11.1.9, 11.5.8, 11.10.7.0) and confirm whether the Agents plugin is installed
- unknown: the sources do not say which exact builds are vulnerable beyond the listed versions

## Fix

- Upgrade Mattermost to a fixed release listed in the advisory (MMSA-2026-00723), such as `11.10.7.0` or later in the 11.10 line, `11.5.8` or later in the 11.5 line, or `11.1.9` or later in the 11.1 line
- unknown: the sources do not name the exact patched Agents plugin version

## Timeline

- 2026-10-26T14:30:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116516

## From the sources

Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_