Read the docs
TI-2022-08539 Aliases CVE-2022-24724

Integer overflow in table parsing extension leads to heap memory corruption

Priority HIGH 76CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing `table.c:row_from_string` may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where `cmark-gfm` is used. If `cmark-gfm` is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the `cmark-gfm` library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0451 91st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed cmark-gfm (github): 0.28.3.gfm.21, 0.29.0.gfm.3Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GitHubcmark-gfmbefore 0.28.3.gfm.21; 0.29.0.gfm.0 to before 0.29.0.gfm.30.28.3.gfm.21, 0.29.0.gfm.3Patch availableCNA
  • cmark-gfm VendorGitHub Affected before 0.28.3.gfm.21; 0.29.0.gfm.0 to before 0.29.0.gfm.3 Fixed in 0.28.3.gfm.21, 0.29.0.gfm.3 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:github:cmark-gfm:*:*:*:*:*:*:*:*before 0.28.3.gfm.21; after 0.28.3.gfm.21, before 0.29.0.gfm.3VulnerableGitHub
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
  • cpe:2.3:a:github:cmark-gfm:*:*:*:*:*:*:*:* Versions before 0.28.3.gfm.21; after 0.28.3.gfm.21, before 0.29.0.gfm.3 Vulnerable ·GitHub
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA cmark-gfm (github) Fixed in 0.28.3.gfm.21, 0.29.0.gfm.3

Red Hat 1 advisory

  • RHSA-2022:5597 Released 2022-07-18 · Red Hat rating Important
    pandoc security update
    • Red Hat Enterprise Linux CRB (v. 8) pandoc-2.0.6-6.el8_6, pandoc-common-2.0.6-6.el8_6

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2022:5597

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24724

References

Exploit 1

Advisory 7

  • TI-2023-11632 Quadratic complexity may lead to a denial of service in cmark-gfm CVSS 3.1HIGH 7.5
  • TI-2023-10324 Quadratic complexity may lead to a denial of service in cmark-gfm CVSS 3.1HIGH 7.5
  • TI-2023-19072 Quadratic complexity bugs may lead to a denial of service CVSS 3.1HIGH 7.5
  • TI-2023-08735 cmark-gfm Quadratic complexity bug in handle_close_bracket may lead to a denial of service CVSS 3.1HIGH 7.5
  • TI-2023-08733 Inefficient Quadratic complexity bug in handle_pointy_brace may lead to a denial of service CVSS 3.1HIGH 7.5
  • TI-2023-08732 cmark-gfm Quadratic complexity bugs may lead to a denial of service CVSS 3.1HIGH 7.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences