CVE-2024-22051

CRITICAL Pub 04/01 Upd 23/06

Overview

This vulnerability is an integer overflow (CWE-190) occurring in CommonMarker prior to version 0.23.4. The root cause lies in the improper handling of marker rows during table parsing, where the number of columns exceeds the maximum value of a 16-bit unsigned integer (UINT16_MAX). This flaw affects the table parsing component responsible for processing markdown input containing tables with excessive columns.

Vulnerability Description

CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.

Impact

An unauthenticated attacker can remotely supply malicious markdown content to trigger heap corruption, enabling information disclosure or arbitrary code execution within the context of the vulnerable application. This can lead to full system compromise or data breaches without requiring user interaction or credentials. The vulnerability enables attackers to bypass normal security controls by exploiting memory corruption during markdown processing.

Solution

Upgrade CommonMarker to version 0.23.4 or later as recommended in the vendor security advisories GHSA-fmx4-26r3-wxpf and GHSA-mc3g-88wq-6f4x. The patch addressing this issue is available in the commit ab4504fd17460627a6ab255bc3c63e8e5fc6aed3 on the official repository. Refer to the vendor advisories for detailed patching instructions and ensure all markdown processing components are updated accordingly.

EPSS vs KEV Prediction — Evolution (30 days)

Affected Products (2)

Vendor Product Version CPE
github Github Cmark-Gfm All cpe:2.3:a:github:cmark-gfm:*:*:*:*:*:*:*:*
gjtorikian Gjtorikian Commonmarker All cpe:2.3:a:gjtorikian:commonmarker:*:*:*:*:*:ruby:*:*

Exploits

No exploits found for this CVE.

Exploited in Wild NOT DETECTED
Ransomware NOT ASSOCIATED
Attacker Interest VERY LOW
Sightings No sightings

Threat Feed

0 events

No threat activity recorded for this CVE.

Likely Kill Chain

Typical exploitation path inferred from this vulnerability's characteristics — mapped to MITRE ATT&CK tactics.

Applicable Out of scope
Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Priv. Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Lateral Movement
TA0008
Collection
TA0009
Impact
TA0040

Highlighted stages are those attackers typically reach when exploiting this CVE. Heuristic based on CWE families — refined by ML classifier when available.

Attack Vectors ML

Integer Overflow
100% integer_overflow
Buffer Overflow
71% buffer_overflow
Remote Code Execution
70% rce

MITRE ATT&CK Techniques (0)

ATT&CK techniques pending

Techniques are derived from this CVE's kill chains once ML classification completes.

CAPEC Attack Patterns ML

ID Name ML Conf. Likelihood Severity Link
CAPEC-92 Forced Integer Overflow
37%
High High

Red Team Playbook

AtomicRedTeam integration in progress

Executable commands will be auto-mapped to each ATT&CK technique of this CVE.

Detection & Response Rules

No detection or response rules found for this CVE.

No news articles found for this CVE.

References (6)

Title Tags URL
nvd.nist.gov
NVD reference
https://nvd.nist.gov/vuln/detail/CVE-2024-22051
github.com
GitHub CVE vendor-advisory
https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
github.com
GitHub CVE vendor-advisory
https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
github.com
GitHub CVE patch
https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3
github.com
GitHub CVE vendor-advisory
https://github.com/advisories/GHSA-fmx4-26r3-wxpf
vulncheck.com
GitHub CVE third-party-advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-fmx4-26r3-wxpf