What is CVE-2026-35201?

CVE-2026-35201 is a medium-severity vulnerability in Davidfstr Rdiscount, classified under Out-of-bounds Read. CVSS score: 5.9/10. Published 2026-04-06.

How severe is CVE-2026-35201?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Out-of-bounds Read in Davidfstr Rdiscount

CVE-2026-35201

Discount is an implementation of John Gruber's Markdown markup language in C. From 1.3.1.1 to before 2.2.7.4, a signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are tr…

Vulnerability class: Buffer Overflow

EPSS: 0.001 (23.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Davidfstr Rdiscount — versions >= 1.3.1.1, < 2.2.7.4

Weakness classification (CWE)

CWE-125 — Out-of-bounds Read

References

https://github.com/davidfstr/rdiscount/security/advisories/GHSA-6r34-94wq-jhrc (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-35201?: CVE-2026-35201 is a medium-severity vulnerability in Davidfstr Rdiscount, classified under Out-of-bounds Read. CVSS score: 5.9/10. Published 2026-04-06.
How severe is CVE-2026-35201?: Medium severity. CVSS v3 base score is 5.9 out of 10.