CVE-2020-26148

Name of the Vulnerable Software and Affected Versions md4c version 0.4.5

Description The issue allows attackers to trigger the use of uninitialized memory and cause a denial of service, such as an assertion failure, via a malformed Markdown document. This is due to a problem in the md push block bytes function in md4c.c.

Recommendations For md4c version 0.4.5, consider avoiding the use of the md push block bytes function until a patch is available. As a temporary workaround, restrict the processing of malformed Markdown documents to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.