CVE-2024-22051: github cmark-gfm Integer Overflow or Wraparound
Vulnerability summary
CVE-2024-22051 is a critical (CVSS 9.8) Integer Overflow or Wraparound vulnerability in github cmark-gfm. EPSS estimates a 1.45% chance of exploitation in the next 30 days, higher than 73.1% of scored vulnerabilities.
Timeline
- 04-01-2024PublishedVulnerability first disclosed.
- 14-07-2026Last modifiedVulnerability information updated.
Description
CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · RubygemsEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.45%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
0.00 pp
From 1.45% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- ruby-commonmarker< 0.23.4-1
Github1 product
- cmark-gfm< 0.28.3.gfm.21 | ≥ 0.29.0.gfm.0, < 0.29.0.gfm.3
Gjtorikian1 product
- commonmarker< 0.23.4
RubyGems1 product
- commonmarker< 0.23.4
Ubuntu1 product
- ruby-commonmarkerAll versions (No fix recorded)
5 vendors · 5 products
References
12 links- github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4xVendor AdvisoryREPORTWEBNot Applicable
