CVE-2022-34913
Published: 02 July 2022
Summary
CVE-2022-34913 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Md2Roff Project Md2Roff. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 6.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
md2roff 1.7 contains a stack-based buffer overflow (CWE-787) triggered when the tool processes a Markdown file that includes a large number of consecutive characters. The vulnerability received a CVSS 3.1 base score of 9.8, reflecting network-accessible attack vectors with no required authentication or user interaction.
An unauthenticated remote attacker can supply a crafted Markdown document to trigger the overflow, resulting in out-of-bounds writes that may be leveraged for arbitrary code execution, information disclosure, or a crash. The vendor has stated that the utility is not intended to handle untrusted input.
The GitHub issue linked in public references documents the flaw but does not describe an official patch or mitigation steps. The EPSS score rose from lower values to a peak of 0.1394, indicating measurable post-disclosure exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-37817
Vulnerability details
md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.