Md4c is a lightweight Markdown parser library deployed across embedded and CLI applications where memory safety is critical to overall system integrity. Although the project maintains a narrow product scope, its positioning in the software supply chain and recurring exposure to memory-safety weaknesses—out-of-bounds reads and writes, use of uninitialized resources, and NULL-pointer dereferences—result in a vulnerability profile that skews strongly toward critical-severity outcomes. Defenders should prioritize tracking downstream products that embed this library and treat parser updates as security-sensitive; current severity and exploitation data are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Md4c Project over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-11547CRITICAL md_is_link_reference_definition_helper in md4c 0.2.5 has a heap-based buffer over-read because md_is_link_label mishandles loop termination. | May 29, 2018 | 9.8 | 31 | NO | NO |
CVE-2018-11546CRITICAL md4c 0.2.5 has a heap-based buffer over-read because md_is_named_entity_contents has an off-by-one error. | May 29, 2018 | 9.8 | 29 | NO | NO |
CVE-2018-11545CRITICAL md4c 0.2.5 has a heap-based buffer overflow in md_merge_lines because md_is_link_label mishandles the case of a link label composed solely of backslash escapes. | May 29, 2018 | 9.8 | 28 | NO | NO |
CVE-2018-11536CRITICAL md4c before 0.2.5 has a heap-based buffer overflow because md_split_simple_pairing_mark mishandles splits. | May 29, 2018 | 9.8 | 28 | NO | NO |
CVE-2020-26148HIGH md_push_block_bytes in md4c.c in md4c 0.4.5 allows attackers to trigger use of uninitialized memory, and cause a denial of service (e.g., assertion failure) via a malformed Markdow | Sep 30, 2020 | 7.5 | 23 | NO | NO |
CVE-2018-12112HIGH md_build_attribute in md4c.c in md4c 0.2.6 allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact | Jun 11, 2018 | 7.8 | 23 | NO | NO |
CVE-2021-30027MEDIUM md_analyze_line in md4c.c in md4c 0.4.7 allows attackers to trigger use of uninitialized memory, and cause a denial of service via a malformed Markdown document. | Apr 29, 2021 | 5.5 | 19 | NO | NO |
CVE-2018-12102MEDIUM md4c 0.2.6 has a NULL pointer dereference in the function md_process_line in md4c.c, related to ctx->current_block. | Jun 11, 2018 | 5.5 | 18 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Md4c Project.
Media articles that mention a CVE ID that affects a product developed by Md4c Project — matched by CVE ID, not by vendor name.