CVE-2022-24724
Integer overflow in table parsing extension leads to heap memory corruption
cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing table.c:row_from_string may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where cmark-gfm is used. If cmark-gfm is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the cmark-gfm library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Integer overflow in table parsing extension leads to heap memory corruption
cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing table.c:row_from_string may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where cmark-gfm is used. If cmark-gfm is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the cmark-gfm library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.
- Record
CVE-2022-24724- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2022-29578
cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing table.c:row_from_string may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where cmark-gfm is used. If cmark-gfm is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the cmark-gfm library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.
- Record
EUVD-2022-29578- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
NVD
cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing table.c:row_from_string may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where cmark-gfm is used. If cmark-gfm is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the cmark-gfm library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.
- Record
CVE-2022-24724- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
Integer overflow in table parsing extension leads to heap memory corruption
cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing table.c:row_from_string may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where cmark-gfm is used. If cmark-gfm is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the cmark-gfm library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.
- Record
CVE-2022-24724- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-24724
cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing table.c:row_from_string may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where cmark-gfm is used. If cmark-gfm is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the cmark-gfm library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.
- Record
DEBIAN-CVE-2022-24724- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVRHSA-2022:5597
Red Hat Security Advisory: pandoc security update
- Record
RHSA-2022:5597- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVRLSA-2022:5597
Important: pandoc security update
Pandoc is a markdown/markup conversion tool. The version of pandoc in Rocky Linux 8 CRB uses cmark-gfm (GitHub's extended version of the C reference implementation of CommonMark) for parts of its conversion. The update, fixes CVE-2022-24724: an integer overflow in cmark-gfm's table row parsing which may lead to heap memory corruption when parsing tables with more than UINT16_MAX columns.
Security Fix(es):
- cmark-gfm: possible RCE due to integer overflow (CVE-2022-24724)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2022:5597- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-24724
cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing table.c:row_from_string may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where cmark-gfm is used. If cmark-gfm is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the cmark-gfm library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.
- Record
UBUNTU-CVE-2022-24724- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2022:5597 No score
Important: pandoc security update
Pandoc is a markdown/markup conversion tool. The version of pandoc in AlmaLinux 8 CRB uses cmark-gfm (GitHub's extended version of the C reference implementation of CommonMark) for parts of its conversion. The update, fixes CVE-2022-24724: an integer overflow in cmark-gfm's table row parsing which may lead to heap memory corruption when parsing tables with more than UINT16_MAX columns. Security Fix(es):
- cmark-gfm: possible RCE due to integer overflow (CVE-2022-24724) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2022:5597- Updated
- 2026-11-02
OSVRSEC-2023-7 No score
Denial of Service (DoS) and Arbitrary Code Execution (ACE) vulnerabilities
cmark-gfm, GitHub's extended CommonMark library, has multiple vulnerabilities. Versions prior to 0.29.0.gfm.6 suffer from a polynomial time complexity issue in the autolink extension, causing denial of service. Also, versions before 0.29.0.gfm.3 and 0.28.3.gfm.21 contain an integer overflow in table row parsing, leading to heap corruption and potential Arbitrary Code Execution. Patches are available in versions 0.29.0.gfm.6, 0.29.0.gfm.3, and 0.28.3.gfm.21. Mitigations include upgrading or disabling affected extensions.
- Record
RSEC-2023-7- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pandocAlmaLinux:8 |
before 2.0.6-6.el8_6 | 2.0.6-6.el8_6 |
pandoc-commonAlmaLinux:8 |
before 2.0.6-6.el8_6 | 2.0.6-6.el8_6 |
cmark-gfmDebian:12 |
before 0.29.0.gfm.3-3 | 0.29.0.gfm.3-3 |
cmark-gfmDebian:13 |
before 0.29.0.gfm.3-3 | 0.29.0.gfm.3-3 |
cmark-gfmDebian:14 |
before 0.29.0.gfm.3-3 | 0.29.0.gfm.3-3 |
ghostwriterDebian:12 |
before 2.1.6+ds-1 | 2.1.6+ds-1 |
ghostwriterDebian:13 |
before 2.1.6+ds-1 | 2.1.6+ds-1 |
ghostwriterDebian:14 |
before 2.1.6+ds-1 | 2.1.6+ds-1 |
python-cmarkgfmDebian:12 |
before 0.7.0-1 | 0.7.0-1 |
python-cmarkgfmDebian:13 |
before 0.7.0-1 | 0.7.0-1 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-cmarkgfmDebian:14 |
before 0.7.0-1 | 0.7.0-1 |
r-cran-commonmarkDebian:12 |
before 1.8.0-1 | 1.8.0-1 |
r-cran-commonmarkDebian:13 |
before 1.8.0-1 | 1.8.0-1 |
r-cran-commonmarkDebian:14 |
before 1.8.0-1 | 1.8.0-1 |
ruby-commonmarkerDebian:12 |
before 0.23.4-1 | 0.23.4-1 |
ruby-commonmarkerDebian:13 |
before 0.23.4-1 | 0.23.4-1 |
ruby-commonmarkerDebian:14 |
before 0.23.4-1 | 0.23.4-1 |
pandocRed Hat:enterprise_linux:8::crb |
before 0:2.0.6-6.el8_6 | 0:2.0.6-6.el8_6 |
pandoc-commonRed Hat:enterprise_linux:8::crb |
before 0:2.0.6-6.el8_6 | 0:2.0.6-6.el8_6 |
pandocRocky Linux:8 |
before 0:2.0.6-6.el8_6 | 0:2.0.6-6.el8_6 |
commonmarkCRAN From an advisory covering 2 CVEs |
0.2 up to 1.8, plus listed versions 0.40.50.60.70.8 Show 8 moreShow less0.91.01.11.21.41.51.61.7 |
1.8 |
cmark-gfmUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 0.28.3.gfm.20-30.29.0.gfm.0-30.29.0.gfm.0-40.29.0.gfm.0-4ubuntu0.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24724 is a high vulnerability (CVSS 8.8) in Github Cmark-gfm, published March 3, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.51%, the 91st percentile. Fixed in pandoc 2.0.6-6.el8_6.
References
github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55K6VNVKO2G5SNKRCQ2KDG5SKTX5PVV
Show 17 moreShow less
packetstormsecurity.com/files/166599/cmark-gfm-Integer-overflow.html
access.redhat.com/errata/RHSA-2022:5597
bugzilla.redhat.com/2060662
errata.almalinux.org/8/ALSA-2022-5597.html
nvd.nist.gov/vuln/detail/CVE-2022-24724
security-tracker.debian.org/tracker/CVE-2022-24724
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5597.json
cve.org/CVERecord?id=CVE-2022-24724
errata.rockylinux.org/RLSA-2022:5597
ubuntu.com/security/CVE-2022-24724