Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-22051 is a critical-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Github Cmark-Gfm. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique LSA Secrets (T1003.004); ranked in the top 27% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CommonMarker versions prior to 0.23.4 contain an integer overflow vulnerability tracked as CVE-2024-22051 and CWE-190. The flaw resides in the library's table parsing logic and is triggered when a marker row specifies more than UINT16_MAX columns, resulting in heap memory corruption that can be reached during Markdown processing.
Unauthenticated remote attackers can exploit the issue over the network by supplying a crafted Markdown document containing an oversized table. Successful exploitation may allow information disclosure or remote code execution, consistent with the CVSS 9.8 rating that reflects no required authentication, user interaction, or special privileges.
Advisories published in the referenced GitHub Security Advisories and the associated commit recommend immediate upgrade to CommonMarker 0.23.4 or later; the fix bounds column counts and eliminates the overflow during table marker processing. The EPSS score has remained flat at 0.1206 with no material increase observed since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-1416
Vulnerability Data
CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables…
more
with marker rows that contain more than UINT16_MAX columns.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.2.6
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (static analysis, fuzzing, unit tests) directly finds integer overflow defects before deployment.
Secure engineering principles require use of safe arithmetic constructs or language features that structurally eliminate integer overflow during calculation.
Input validation enforces bounds on values before arithmetic, stopping the conditions that trigger overflow or wraparound.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require use of safe arithmetic, bounds checks, and testing that prevent integer overflows.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.