Log in Start free

Vulnerability · Published Mar 26, 2026 · Assigned by VulDB

CVE-2026-4833Orc discount Markdown markdown.c compile recursion

Low 3.3

In plain English

A low-severity security flaw in discount from Orc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.1%top 98.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler. This manipulation causes uncontrolled recursion. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project maintainer confirms: "[I]f you feed it an infinitely deep blockquote input it will crash. (...) [T]his is a duplicate of an old bug that I've been working on."

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12discountno fix listedDEBIAN-CVE-2026-4833
Debian:13discountno fix listedDEBIAN-CVE-2026-4833
Debian:14discountno fix listedDEBIAN-CVE-2026-4833
Ubuntu:22.04:LTSdiscountno fix listedUBUNTU-CVE-2026-4833
Ubuntu:24.04:LTSdiscountno fix listedUBUNTU-CVE-2026-4833
Ubuntu:25.10discountno fix listedUBUNTU-CVE-2026-4833
Ubuntu:26.04:LTSdiscountno fix listedUBUNTU-CVE-2026-4833
Ubuntu:26.10discountno fix listedUBUNTU-CVE-2026-4833

Affected products (as reported)

VendorProductVersions
Orc discount 3.0.1.03.0.1.13.0.1.2

Weakness: CWE-674, CWE-404 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C

References