CVE-2022-41220

CRITICAL

md2roff 1.9 - Stack-based Buffer Overflow via Markdown File

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-41220. PoCs published by Halcy0nic.

AI-analyzed exploit summary This repository provides a working proof-of-concept for CVE-2022-41220, demonstrating a stack-based buffer overflow in md2roff 1.9 via a specially crafted Markdown file. The PoC includes replication steps, ASAN output, and GDB analysis confirming the vulnerability.

Description

md2roff 1.9 has a stack-based buffer overflow via a Markdown file, a different vulnerability than CVE-2022-34913. NOTE: the vendor's position is that the product is not intended for untrusted input

Exploits (1)

nomisec WORKING POC 1 stars
by Halcy0nic · poc
https://github.com/Halcy0nic/CVE-2022-41220

This repository provides a working proof-of-concept for CVE-2022-41220, demonstrating a stack-based buffer overflow in md2roff 1.9 via a specially crafted Markdown file. The PoC includes replication steps, ASAN output, and GDB analysis confirming the vulnerability.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: md2roff 1.9
No auth needed
Prerequisites: Vulnerable version of md2roff (1.9) · Ability to execute the binary with a malicious Markdown file
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/nereusx/md2roff/issues/5

Scores

CVSS v3 9.8
EPSS 0.0140
EPSS Percentile 68.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-787
Status published
Products (1)
md2roff_project/md2roff 1.9
Published Sep 21, 2022
Tracked Since Feb 18, 2026