PT-2026-28186 · Unknown · Orc Discount

Mthg · Publicado 2026-03-26 · Atualizado 2026-03-26 · CVE-2026-4833

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Orc discount versions up to 3.0.1.2

Description A flaw exists in the Markdown Handler component of Orc discount, specifically within the compile function of the markdown.c file. This issue leads to uncontrolled recursion, allowing for local execution of attacks. The exploit is publicly available. The project maintainer acknowledges this as a duplicate of a previously known bug involving an infinitely deep blockquote input causing a crash.

Recommendations Versions prior to 3.0.1.2 should be updated.

Exploit

Correção

Improper Resource Release

Uncontrolled Recursion

Enumeração de Fraquezas

CWE-404

CWE-674

Identificadores relacionados

CVE-2026-4833

Produtos afetados

Orc Discount

Referências · 14

• 🔥❌ https://github.com/user-attachments/files/25847391/crash00.md · Exploit, Deleted
• https://github.com/Orc/discount/issues/305#issuecomment-4027546673 · Nota
• https://github.com/Orc/discount/issues/305 · Nota
• https://vuldb.com/?submit.775841 · Nota
• https://vuldb.com/?id.353138 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-4833 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-4833 · Nota de Segurança
• https://twitter.com/CVEnew/status/2037137761073860938 · Publicação no Twitter
• https://github.com/Orc/discount · Nota
• https://vuldb.com/?ctiid.353138 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4833 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2026-4833 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-4833 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-4833 · Aviso do Fabricante