CVE-2023-22485

Katalog CVE

CVSS 5.3 · Medium EPSS 0,72%

Kerentanan Out-of-bounds Read pada github cmark-gfm. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document can trigger an out-of-bounds read in the `validate_protocol` function. We believe this bug is harmless in practice, because the out-of-bounds read accesses `malloc` metadata without causing any visible damage.This vulnerability has been patched in 0.29.0.gfm.7.

Rincian

Terbit di NVD

24 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read
CWE-91: XML Injection (aka Blind XPath Injection)

EPSS (30 hari)

0,72% peluang dieksploitasi; lebih tinggi dari 52,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/github/cmark-gfm/security/advisories/GHSA-c944-cv5f-hpvr exploit · advisory pihak ketiga