Critical severity · published Jan 4, 2024
CVE-2024-22051
CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability
9.8
CVSS
1.5%
EPSS
No
On KEV
Description
CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Cmark-gfm · Github
before 0.28.3.gfm.21; 0.29.0.gfm.0 before 0.29.0.gfm.3 · source: NVD
CO
Commonmarker · Gjtorikian
before 0.23.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-22051
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-22051
Third Party Advisory
https://github.com/advisories/GHSA-fmx4-26r3-wxpf
Not Applicable
https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
Patch
https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3
Vendor Advisory
https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
Third Party Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-fmx4-26r3-wxpf
More from Cmark-gfm
9.8
CVE-2022-24724
cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark
7.5
CVE-2023-37463
cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec
7.5
CVE-2023-26485
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C
7.5
CVE-2023-24824
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C
7.5
CVE-2023-22486
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C