by Kastro
Paper/Archive/CVE-2024-22051

CVE-2024-22051

VulnCheck — CommonMarker Integer Overflow Vulnerability

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 73.4.734 × 2014.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.

Affected

ProductAffectedFixed inSource
commonmarker< 0.23.40.23.4CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorygithub.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4xadvisorygithub.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpfpatchgithub.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3advisorygithub.com/advisories/GHSA-fmx4-26r3-wxpfwriteupvulncheck.com/advisories/vc-advisory-GHSA-fmx4-26r3-wxpf