CVE-2022-24724: Integer overflow in table parsing extension leads to heap memory corruption
cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing table.c:rowfromstring may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where cmark-gfm is used. If cmark-gfm is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the cmark-gfm library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cmark-gfmto a version that resolves this vulnerability.Fixed in 0.29.0.gfm.6-6Fixed in 0.29.0.gfm.13-4Fixed in 0.29.0.gfm.13-7.1 - Upgrade
Upgrade
debian/ghostwriterto a version that resolves this vulnerability.Fixed in 2.1.6+ds-2Fixed in 25.04.0+ds-1Fixed in 26.04.0+ds-1 - Upgrade
Upgrade
debian/python-cmarkgfmto a version that resolves this vulnerability.Fixed in 0.8.0-3Fixed in 2024.11.20-1Fixed in 2025.10.22-2 - Upgrade
Upgrade
debian/r-cran-commonmarkto a version that resolves this vulnerability.Fixed in 1.8.1-1Fixed in 1.9.5-1Fixed in 2.0.0-3 - Upgrade
Upgrade
debian/ruby-commonmarkerto a version that resolves this vulnerability.Fixed in 0.23.6-1Fixed in 0.23.10-1Fixed in 2.10.1-1 - Upgrade
Upgrade
debian/cmark-gfmto a version that resolves this vulnerability.Fixed in 0.29.0.gfm.3-3 - Upgrade
Upgrade
debian/ghostwriterto a version that resolves this vulnerability.Fixed in 2.1.6+ds-1 - Upgrade
Upgrade
debian/python-cmarkgfmto a version that resolves this vulnerability.Fixed in 0.7.0-1 - Upgrade
Upgrade
debian/r-cran-commonmarkto a version that resolves this vulnerability.Fixed in 1.8.0-1 - Upgrade
Upgrade
debian/ruby-commonmarkerto a version that resolves this vulnerability.Fixed in 0.23.4-1 - Upgrade
Upgrade
cmark-gfmto a version that resolves this vulnerability.Fixed in 0.29.0.gfm.3 - Upgrade
Upgrade
cmark-gfmto a version that resolves this vulnerability.Fixed in 0.28.3.gfm.21 - Configuration
Disable the table extension to prevent the vulnerability from being triggered.
cmark-gfm table extension = disabled
Event History
Frequently Asked Questions
What is CVE-2022-24724?
CVE-2022-24724 is an integer overflow vulnerability in cmark-gfm that may lead to heap memory corruption when parsing tables.
What is the severity of CVE-2022-24724?
The severity of CVE-2022-24724 is critical (9.8 out of 10).
How does CVE-2022-24724 affect GitHub's cmark-gfm?
GitHub's cmark-gfm versions up to 0.28.3.gfm.21 are affected by CVE-2022-24724.
How do I fix CVE-2022-24724 in cmark-gfm?
Update cmark-gfm to version 0.29.0.gfm.3 or later to fix CVE-2022-24724.
Are Fedora 34, 35, and 36 affected by CVE-2022-24724?
Yes, Fedora 34, 35, and 36 are affected by CVE-2022-24724.