CVE-2026-4833CWE-404CWE-674

Orc discount Markdown markdown.c compile recursion

Medium · published March 26, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
4.9
In the wild
Unconfirmed
What it is

A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler. This manipulation causes uncontrolled recursion. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project maintainer confirms: "[I]f you feed it an infinitely deep blockquote input it will crash. (...) [T]his is a duplicate of an old bug that I've been working on."

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00161 · 4.9th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-674 · Uncontrolled Recursion
Published
2026-03-26T01:02Z
EPSS history
Timeline
  • 26 MAR 01:02Z
    Orc discount Markdown markdown.c compile recursion
    cvelistv5