# CVE-2022-24724: pandoc: Pandoc is a markdown/markup conversion tool

CVE-2022-24724 is fixed in 7 products on 1 platform, first by DEBIAN-CVE-2022-24724, released March 3, 2022. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2022-24724
- Priority: High
- CVSS: 9.8 (Important)
- EPSS: 0.0451
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 3, 2022

## Description

Pandoc is a markdown/markup conversion tool. The version of pandoc in RHEL 8 CRB uses cmark-gfm (GitHub's extended version of the C reference implementation of CommonMark) for parts of its conversion. The update, fixes CVE-2022-24724: an integer overflow in cmark-gfm's table row parsing which may lead to heap memory corruption when parsing tables with more than UINT16_MAX columns.  Security Fix(es):  * cmark-gfm: possible RCE due to integer overflow (CVE-2022-24724)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | cmark-gfm Debian 12.15 (bookworm) | 0.29.0.gfm.3-3 | [DEBIAN-CVE-2022-24724](https://patchblox.com/security/data/fix/linux/debian-cve-2022-24724.md) | Mar 3, 2022 |
| Linux | cmark-gfm Debian 13.5 (trixie) | 0.29.0.gfm.3-3 | [DEBIAN-CVE-2022-24724](https://patchblox.com/security/data/fix/linux/debian-cve-2022-24724.md) | Mar 3, 2022 |
| Linux | cmark-gfm Debian 14 | 0.29.0.gfm.3-3 | [DEBIAN-CVE-2022-24724](https://patchblox.com/security/data/fix/linux/debian-cve-2022-24724.md) | Mar 3, 2022 |
| Linux | ghostwriter Debian 12.15 (bookworm) | 2.1.6+ds-1 | [DEBIAN-CVE-2022-24724](https://patchblox.com/security/data/fix/linux/debian-cve-2022-24724.md) | Mar 3, 2022 |
| Linux | ghostwriter Debian 13.5 (trixie) | 2.1.6+ds-1 | [DEBIAN-CVE-2022-24724](https://patchblox.com/security/data/fix/linux/debian-cve-2022-24724.md) | Mar 3, 2022 |
| Linux | ghostwriter Debian 14 | 2.1.6+ds-1 | [DEBIAN-CVE-2022-24724](https://patchblox.com/security/data/fix/linux/debian-cve-2022-24724.md) | Mar 3, 2022 |
| Linux | pandoc RHEL 8 | 0:2.0.6-6.el8_6 | [RHSA-2022:5597](https://patchblox.com/security/data/fix/linux/rhsa-2022-5597.md) | Jul 18, 2022 |
| Linux | pandoc almalinux 8 | 2.0.6-6.el8_6 | [ALSA-2022:5597](https://patchblox.com/security/data/fix/linux/alsa-2022-5597.md) | Jul 18, 2022 |
| Linux | pandoc rocky 8 | 0:2.0.6-6.el8_6 | [RLSA-2022:5597](https://patchblox.com/security/data/fix/linux/rlsa-2022-5597.md) | Jun 28, 2026 |
| Linux | pandoc-common RHEL 8 | 0:2.0.6-6.el8_6 | [RHSA-2022:5597](https://patchblox.com/security/data/fix/linux/rhsa-2022-5597.md) | Jul 18, 2022 |
| Linux | pandoc-common almalinux 8 | 2.0.6-6.el8_6 | [ALSA-2022:5597](https://patchblox.com/security/data/fix/linux/alsa-2022-5597.md) | Jul 18, 2022 |
| Linux | python-cmarkgfm Debian 12.15 (bookworm) | 0.7.0-1 | [DEBIAN-CVE-2022-24724](https://patchblox.com/security/data/fix/linux/debian-cve-2022-24724.md) | Mar 3, 2022 |
| Linux | python-cmarkgfm Debian 13.5 (trixie) | 0.7.0-1 | [DEBIAN-CVE-2022-24724](https://patchblox.com/security/data/fix/linux/debian-cve-2022-24724.md) | Mar 3, 2022 |
| Linux | python-cmarkgfm Debian 14 | 0.7.0-1 | [DEBIAN-CVE-2022-24724](https://patchblox.com/security/data/fix/linux/debian-cve-2022-24724.md) | Mar 3, 2022 |
| Linux | r-cran-commonmark Debian 12.15 (bookworm) | 1.8.0-1 | [DEBIAN-CVE-2022-24724](https://patchblox.com/security/data/fix/linux/debian-cve-2022-24724.md) | Mar 3, 2022 |
| Linux | r-cran-commonmark Debian 13.5 (trixie) | 1.8.0-1 | [DEBIAN-CVE-2022-24724](https://patchblox.com/security/data/fix/linux/debian-cve-2022-24724.md) | Mar 3, 2022 |
| Linux | r-cran-commonmark Debian 14 | 1.8.0-1 | [DEBIAN-CVE-2022-24724](https://patchblox.com/security/data/fix/linux/debian-cve-2022-24724.md) | Mar 3, 2022 |
| Linux | ruby-commonmarker Debian 12.15 (bookworm) | 0.23.4-1 | [DEBIAN-CVE-2022-24724](https://patchblox.com/security/data/fix/linux/debian-cve-2022-24724.md) | Mar 3, 2022 |
| Linux | ruby-commonmarker Debian 13.5 (trixie) | 0.23.4-1 | [DEBIAN-CVE-2022-24724](https://patchblox.com/security/data/fix/linux/debian-cve-2022-24724.md) | Mar 3, 2022 |
| Linux | ruby-commonmarker Debian 14 | 0.23.4-1 | [DEBIAN-CVE-2022-24724](https://patchblox.com/security/data/fix/linux/debian-cve-2022-24724.md) | Mar 3, 2022 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.