CVE-2022-24724 Integer overflow in table parsing extension leads to heap memory corruption

High 8.8 Published 3 Mar 2022 Updated 22 Apr 2025

Integer overflow in cmark-gfm table parsing allows heap corruption, potentially leading to remote code execution or information disclosure in applications rendering user-controlled markdown.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-24724?

CVE-2022-24724 is a high-severity vulnerability in Fedoraproject Fedora, published on 3 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing `table.c:row_from_string` may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where `cmark-gfm` is used. If `cmark-gfm` is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the `cmark-gfm` library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.

Weakness: CWE-190

Which versions are affected by CVE-2022-24724?

It affects 2 products.

Linux distribution packages (5)

`pandoc` AlmaLinux:8	All versions	`2.0.6-6.el8_6`
`pandoc-common` AlmaLinux:8	All versions	`2.0.6-6.el8_6`
`pandoc` Red Hat:enterprise_linux:8::crb	All versions	`0:2.0.6-6.el8_6`
`pandoc-common` Red Hat:enterprise_linux:8::crb	All versions	`0:2.0.6-6.el8_6`
`pandoc` Rocky Linux:8	All versions	`0:2.0.6-6.el8_6`

Products include Fedoraproject Fedora, Github Cmark-Gfm.

How do I fix CVE-2022-24724?

Upgrade to a fixed version.

Is CVE-2022-24724 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24724 exists.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as ALSA-2022:5597, DEBIAN-CVE-2022-24724, GHSA-mc3g-88wq-6f4x, RHSA-2022:5597, RLSA-2022:5597, UBUNTU-CVE-2022-24724.