Login Request a demo
Critical severity · published Jan 4, 2024
CVE-2024-22051
CommonMarker Integer Overflow Vulnerability
9.8
CVSS
1.5%
EPSS
No
On KEV
Description
CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Cmark-gfm · Github
before 0.28.3.gfm.21; 0.29.0.gfm.0 before 0.29.0.gfm.3 · source: NVD
CO
Commonmarker · Gjtorikian
before 0.23.4 · source: NVD
Affected product
CM
Cmark-gfm
Github
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-22051
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-22051
Third Party Advisory
https://github.com/advisories/GHSA-fmx4-26r3-wxpf
Not Applicable
https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
Patch
https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3
Vendor Advisory
https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
Third Party Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-fmx4-26r3-wxpf
More from Cmark-gfm
9.8
CVE-2022-24724
cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark
7.5
CVE-2023-37463
Quadratic complexity bugs may lead to a denial of service
7.5
CVE-2023-24824
Quadratic complexity may lead to a denial of service in cmark-gfm
7.5
CVE-2023-26485
Quadratic complexity may lead to a denial of service in cmark-gfm
7.5
CVE-2023-22486
cmark-gfm Quadratic complexity bug in handle_close_bracket may lead to a denial of service