CVE-2022-24724

Deeper analysis

cmark-gfm is GitHub's fork of the C reference implementation of CommonMark. CVE-2022-24724 is an integer overflow in the table-row parser (table.c:row_from_string) that occurs when a marker row contains more than UINT16_MAX columns. The flaw affects all versions prior to 0.29.0.gfm.3 and 0.28.3.gfm.21 and produces heap memory corruption whose consequences range from information disclosure to arbitrary code execution.

An attacker who can supply Markdown containing an oversized table can trigger the overflow when an application renders that content with an affected cmark-gfm build. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, the issue is exploitable over the network by any authenticated user whose input reaches the parser, potentially yielding remote code execution in services that process untrusted Markdown with the table extension enabled.

The GitHub Security Advisory and downstream Fedora notices state that the vulnerability is fixed in the two releases listed above. They also note that disabling the table extension entirely prevents the parser path from being reached. Public references include a proof-of-concept on Packet Storm and multiple distribution advisories confirming the availability of updated packages.

EPSS for the CVE rose from a low baseline to a peak of 0.1296 on 2025-01-22 before receding to the current value of 0.0419, indicating measurable post-disclosure exploitation interest.