CVE-2024-22051

CriticalCVSS 9.8/10Last modified Jul 14, 2026

Description

CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

No affected versions have been published.

Timeline

Published: Jan 4, 2024
Last modified: Jul 14, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-220527.5A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthen CVE-2024-220538.2A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated mal CVE-2024-220547.5A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device ma CVE-2024-220587.8A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute arbitrary code with elevated CVE-2024-220598.8A SQL injection vulnerability in web component of Ivanti Neurons for ITSM allows a remote authenticated user to read/modify/delete informati CVE-2024-22066.5An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the `/proxy` route. Attackers CVE-2024-220604.9An unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a remote, authenticated, high privileged user t CVE-2024-220619.8A Heap Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to ex CVE-2024-220628.8There is a permissions and access control vulnerability in ZXCLOUD IRAI.An attacker can elevate non-administrator permissions to administrat CVE-2024-220639.0The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability. An authenticated attacker can exploit this vulnerabili CVE-2024-220646.5ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique crypt CVE-2024-220658.8There is a command injection vulnerability in ZTE MF258 Pro product. Due to insufficient validation of Ping Diagnosis interface parameter, a