CVE-2018-11546
📋 TL;DR
CVE-2018-11546 is a heap-based buffer over-read vulnerability in md4c 0.2.5 due to an off-by-one error in md_is_named_entity_contents. This allows attackers to read memory beyond allocated buffers, potentially leading to information disclosure or crash. Any application using vulnerable md4c versions for Markdown parsing is affected.
💻 Affected Systems
- md4c
📦 What is this software?
Md4c by Md4c Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution through memory corruption leading to complete system compromise.
Likely Case
Application crash (denial of service) or information disclosure from heap memory.
If Mitigated
Limited impact with proper memory protections (ASLR, DEP) and input validation.
🎯 Exploit Status
Proof of concept available in GitHub issue. Exploitation requires feeding malicious Markdown to vulnerable parser.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.2.6 and later
Vendor Advisory: https://github.com/mity/md4c/issues/38
Restart Required: Yes
Instructions:
1. Update md4c to version 0.2.6 or later. 2. Rebuild applications using md4c. 3. Restart affected services.
🔧 Temporary Workarounds
Input validation
allSanitize or reject Markdown input containing HTML named entities before processing.
Disable HTML entity parsing
allConfigure md4c to skip HTML entity parsing if not required.
🧯 If You Can't Patch
- Isolate md4c usage to trusted input sources only
- Implement application-level memory protection (ASLR, DEP)
🔍 How to Verify
Check if Vulnerable:
Check if md4c version <= 0.2.5 is installed or linked by applications.Check Version:
md4c --version (if available) or check library version in build configurationVerify Fix Applied:
Verify md4c version >= 0.2.6 is installed and applications are rebuilt with updated library.📡 Detection & Monitoring
Log Indicators:
- Application crashes, segmentation faults, abnormal termination when processing Markdown
Network Indicators:
- Unusual Markdown content with HTML entities being submitted
SIEM Query:
process_name:md4c AND (event_type:crash OR exit_code:139)