CVE-2023-22485: github cmark-gfm Out-of-bounds Read

Vulnerability summary

CVE-2023-22485 is a medium (CVSS 5.3) Out-of-bounds Read vulnerability in github cmark-gfm. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 53.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 24-01-2023
   PublishedVulnerability first disclosed.
2. 10-03-2025
   Last modifiedVulnerability information updated.

Description

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document can trigger an out-of-bounds read in the `validate_protocol` function. We believe this bug is harmless in practice, because the out-of-bounds read accesses `malloc` metadata without causing any visible damage.This vulnerability has been patched in 0.29.0.gfm.7.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-91XML Injection (aka Blind XPath Injection)The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.