CVE-2023-22485 - CVE House
Back to Database
Status published Medium CVE-2023-22485

cmark-gfm out-of-bounds read in validate_protocol

Vulnerability Description

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document can trigger an out-of-bounds read in the `validate_protocol` function. We believe this bug is harmless in practice, because the out-of-bounds read accesses `malloc` metadata without causing any visible damage.This vulnerability has been patched in 0.29.0.gfm.7.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-22485

Credits & Attribution

No credits recorded in the NVD database.

References

More from github

View All →
CVE-2025-24362
CodeQL GitHub Action failed workflow writes GitHub PAT to debug artifacts
High 7.1
CVE-2024-25129
Limited data exfiltration in CodeQL CLI
Low 2.7
CVE-2023-37463
Quadratic complexity bugs may lead to a denial of service
Medium 6.4
CVE-2023-26485
Quadratic complexity may lead to a denial of service in cmark-gfm
Medium 5.3
CVE-2023-24824
Quadratic complexity may lead to a denial of service in cmark-gfm
Medium 5.3

Affected Vendor

Affected Software

cmark-gfm
Vulnerable Versions:
< 0.29.0.gfm.7

Timeline

Official Publish: January 24th, 2023
Last Modified: March 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-125

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1213 Data from Information Repositories
Collection
T1003 OS Credential Dumping
Credential Access
T1552 Unsecured Credentials
Credential Access