CVE-2026-35201

Discount is an implementation of John Gruber's Markdown markup language in C. From 1.3.1.1 to before 2.2.7.4, a signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process. This vulnerability is fixed in 2.2.7.4.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/davidfstr/rdiscount/security/advisories/GHSA-6r34-94wq-jhrc	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dafoster:rdiscount:*:*:*:*:*:ruby:*:*

History

No history.

Information

Published : 2026-04-06 20:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-35201

Mitre link : CVE-2026-35201

CVE.ORG link : CVE-2026-35201

JSON object : View

Products Affected

dafoster

rdiscount

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-35201", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35201", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T16:21:05.300982Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "davidfstr", "product": "rdiscount", "versions": [{"status": "affected", "version": ">= 1.3.1.1, < 2.2.7.4"}]}]}], "published": "2026-04-06T20:16:27.893", "references": [{"url": "https://github.com/davidfstr/rdiscount/security/advisories/GHSA-6r34-94wq-jhrc", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "Discount is an implementation of John Gruber's Markdown markup language in C. From 1.3.1.1 to before 2.2.7.4, a signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process. This vulnerability is fixed in 2.2.7.4."}, {"lang": "es", "value": "Discount es una implementaci\u00f3n del lenguaje de marcado Markdown de John Gruber en C. Desde la 1.3.1.1 hasta antes de la 2.2.7.4, un error de truncamiento de longitud con signo causa una lectura fuera de l\u00edmites en la ruta de an\u00e1lisis de Markdown predeterminada. Las entradas mayores que INT_MAX se truncan a un entero con signo antes de entrar al analizador nativo, permitiendo que el analizador lea m\u00e1s all\u00e1 del final del b\u00fafer suministrado y bloquee el proceso. Esta vulnerabilidad se corrige en la 2.2.7.4."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dafoster:rdiscount:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "CD92C2DB-DEF1-4154-A725-76F41B1A0BBC", "versionEndExcluding": "2.2.7.4", "versionStartIncluding": "1.3.1.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}