CVE-2026-86303
Received Received - Intake

Out-of-Bounds Read in 92181 Markdown

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulDB

Description
A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue is the function lds of the file md.c. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. This patch is called c000d2f9cf390c315378d3717cf20911cf3e80a6. A patch should be applied to remediate this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86303
EUVD
EUVD-2026-72359

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
92181 markdown to 058cab0cb7fb245a0ccc6b8446963ff8d573558f (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read issue in the markdown parser 92181 markdown. It occurs in the lds function of the md.c file when processing input ending with a newline character. The function fails to validate buffer bounds before reading a character, causing it to read one byte beyond the allocated memory. This can lead to crashes or undefined behavior.

Detection Guidance

To detect this vulnerability, inspect the version of the 92181 markdown parser in use. Check if the input ends with a newline character, which triggers the out-of-bounds read in the lds() function. Use static analysis tools to identify improper buffer handling in the md.c file.

Impact Analysis

The vulnerability can cause crashes in applications using the markdown parser, especially when built with AddressSanitizer. It may also lead to unstable parsing or denial of service by corrupting memory. Attackers could exploit this remotely by providing specially crafted markdown input.

Mitigation Strategies

Apply the patch c000d2f9cf390c315378d3717cf20911cf3e80a6 to update the lds() function with bounds checking. Alternatively, avoid processing markdown inputs ending with newlines until the patch is applied. Monitor for crashes or undefined behavior in AddressSanitizer builds.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86303. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart