vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-86303

92181 markdown md.c lds out-of-bounds

HIGH
7.3
CVSS Score
Published: September 7, 2026 at 12:15 PM UTC
Updated: September 8, 2026 at 01:31 PM UTC
1 product affected across 1 vendorMarkdown

Using markdown by 92181?

Get instant alerts when new vulnerabilities affect markdown - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.3
Exploit prediction
EPSS 0.5%
SSVC
PoC

Description

A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue is the function lds of the file md.c. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. This patch is called c000d2f9cf390c315378d3717cf20911cf3e80a6. A patch should be applied to remediate this issue.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Markdown· 92181
60%
58cab0cb7fb245a0ccc6b8446963ff8d573558f

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (8)

VDB EntryTechnical Description
Source: cverecord
https://vuldb.com/vuln/399467
SignaturePermissions Required
Source: cverecord
https://vuldb.com/vuln/399467/cti
Third Party Advisory
Source: cverecord
https://vuldb.com/cve/CVE-2026-86303
Third Party Advisory
Source: cverecord
https://vuldb.com/submit/907499
Issue Tracking
Source: cverecord
https://github.com/92181/markdown/issues/1
Issue TrackingPatch
Source: cverecord
https://github.com/92181/markdown/pull/2
Patch
Source: cverecord
https://github.com/92181/markdown/commit/c000d2f9cf390c315378d3717cf20911cf3e80a6
Product
Source: cverecord
https://github.com/92181/markdown/

SSVC — Action Prioritization

SSVCPoCAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.3HIGHVulDB
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-125CWE-119

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card