PT-2022-7229 · Unknown+2 · Commonmarker+2

Felix Wilhelm · Published 2022-03-03 · Updated 2025-11-29 · CVE-2024-22051

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CommonMarker versions prior to 0.23.4

Description The issue is related to an integer overflow vulnerability in the CommonMarker library. This vulnerability can be exploited by remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution. The vulnerability occurs when parsing tables with marker rows that contain more than UINT16 MAX columns.

Recommendations For CommonMarker versions prior to 0.23.4, update to version 0.23.4 to resolve the issue. As a temporary workaround, consider disabling the use of the table extension in cmark-gfm to prevent the vulnerability from being triggered.

Exploit

Fix

RCE

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2024-00321

CESA-2022_5597

CVE-2024-22051

GHSA-C2V4-CHX5-VFF6

GHSA-FMX4-26R3-WXPF

GHSA-MC3G-88WQ-6F4X

RHSA-2022_5597

Affected Products

Commonmarker

Debian

Cmark-Gfm

References · 22

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/CVE-2024-22051.yml · Exploit
• https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3 · Patch
• https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c2v4-chx5-vff6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22051 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-22051 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-22051 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00321 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-22051 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-22051 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22051 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-22051 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fmx4-26r3-wxpf · Vendor Advisory
• https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x · Note
• https://github.com/gjtorikian/commonmarker · Note