CVE-2022-24724

Name of the Vulnerable Software and Affected Versions cmark-gfm versions prior to 0.29.0.gfm.3 and 0.28.3.gfm.21

Description The issue is related to an integer overflow in cmark-gfm's table row parsing, which may lead to heap memory corruption when parsing tables with more than UINT16 MAX columns. This can result in Information Leak or Arbitrary Code Execution, depending on how and where cmark-gfm is used. If cmark-gfm is used for rendering remote user-controlled markdown, this may lead to Remote Code Execution (RCE) in applications employing affected versions of the cmark-gfm library.

Recommendations To resolve the issue, update to version 0.29.0.gfm.3 or 0.28.3.gfm.21, or later. As a temporary workaround, consider disabling the table extension in cmark-gfm to prevent this vulnerability from being triggered.