Description
Denial-of-service condition in M-Files Server versions before 25.11.15392.1, before 25.2 LTS SR2, and before 25.8 LTS SR2 allows an authenticated user to cause the MFserver process to crash.
Affected products
M-Files Server before 25.11.15392.1 M-Files Server before 25.2 LTS SR2 (25.2.14524.13) M-Files Server before 25.8 LTS SR2 (25.8.15085.17)
Not affected products
25.2.14524.13 25.8.15085.17
More information
Calling a specific gRPC method with a specific request type results in MFserver crash. CVSS 4.0 CVSS-Base Score: 7.1 CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CWE: CWE-400 Uncontrolled Resource Consumption CAPEC: CAPEC-492 Regular Expression Exponential Blowup Internal ID: CFO-440 Date issued: 2025-11-17 Alternate IDs: EUVD-2025-197786
Exploitability
Publicly disclosed: No Exploited: No Probability of exploitation: low – internally found
Links
History
2025-11-17 Published
