CVE-2026-4833: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-4833 is an uncontrolled recursion (stack exhaustion) vulnerability in Orc discount, a C implementation of the Markdown markup language. It affects the compile() function in markdown.c within the Markdown Handler component, and impacts discount versions up to and including 3.0.1.2 (confirmed affected: 3.0.1.0, 3.0.1.1, 3.0.1.2). The issue was reported on March 9, 2026, and published to NVD on March 26, 2026 (GitHub Issue, ENISA EUVD). It carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 4.8 (Medium) (ENISA EUVD).

The root cause is uncontrolled recursion (CWE-674) combined with improper resource shutdown (CWE-404) in the compile() function located at line 1445 of markdown.c. When discount processes a maliciously crafted Markdown file containing excessively deeply nested blockquote structures (e.g., thousands of > characters on a single line), compile() recursively calls itself without a depth limit, eventually exhausting the process stack and causing a segmentation fault. Specifically, compile() invokes the Pp() function (line 1443), which then attempts a calloc allocation (line 1214) that triggers a stack-overflow exception detectable by AddressSanitizer. Exploitation requires local access and the ability to supply a crafted input file to the markdown binary (e.g., ./markdown -G crash00.md); a proof-of-concept crash file (crash00.md) consisting of thousands of nested > characters has been publicly released (GitHub Issue, PoC File).

Successful exploitation causes the discount process to crash with a segmentation fault, resulting in a denial-of-service condition for any application or pipeline relying on discount for Markdown rendering. There is no impact on confidentiality or integrity — only availability is affected, and the scope is limited to the vulnerable process itself. Applications that process untrusted Markdown input using the discount library (e.g., static site generators, documentation tools, or web services) are at risk if an attacker can supply crafted input locally (GitHub Issue, ENISA EUVD).

A proof-of-concept exploit file (crash00.md) has been publicly released and is available via the GitHub issue tracker, confirming the vulnerability is reproducible with minimal effort (PoC File). The CVSS v4.0 exploit maturity is rated "Proof of Concept." The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of widespread exploitation in the near term. There is no evidence of in-the-wild exploitation, threat actor attribution, or inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is restricted to local attack vectors, requiring low privileges and no user interaction (ENISA EUVD).

1. Prepare the malicious input: Create a Markdown file (crash00.md) containing an extremely long line of nested blockquote characters — thousands of consecutive > characters (e.g., >>>>...>>>> repeated thousands of times on a single line), as demonstrated in the public PoC.
2. Obtain local access: Gain local access to a system running a vulnerable version of discount (≤ 3.0.1.2), or identify an application that passes user-controlled Markdown content to the discount library.
3. Trigger the vulnerability: Execute the discount binary with the crafted file: ./markdown -G crash00.md. Alternatively, supply the crafted content to any application using the discount library for Markdown parsing.
4. Observe crash: The compile() function in markdown.c enters uncontrolled deep recursion processing the nested blockquotes, exhausts the process stack, and crashes with a segmentation fault (SIGSEGV), causing a denial of service (GitHub Issue, PoC File).

• Process: Unexpected termination (segmentation fault / SIGSEGV) of the markdown binary or any process embedding the discount library while processing Markdown input.
• Logs: Application or system logs showing crash signals (e.g., SIGSEGV, DEADLYSIGNAL) originating from the discount/markdown process; AddressSanitizer output referencing compile() at markdown.c:1445 or Pp() at markdown.c:1443.
• File System: Presence of unusually large or deeply nested Markdown files (e.g., files containing thousands of consecutive > characters) in directories processed by discount.
• Core Dumps: Core dump files generated by the markdown process in the working directory or system core dump location (GitHub Issue).

No official patched release has been confirmed as of the time of this report; the issue remains open on the project's GitHub tracker. The project maintainer has acknowledged the bug as a duplicate of a previously known issue and indicated active work on a fix (GitHub Issue). As a workaround, the reporter suggests introducing a MAX_NESTING_DEPTH constant (e.g., 100–200) and a depth counter in the parsing context to abort deep recursion and treat remaining data as plain text. Organizations using discount should monitor the upstream repository for a patched release, restrict processing of untrusted Markdown input, and consider sandboxing or resource-limiting (e.g., ulimit -s) the discount process to reduce crash impact.

The project maintainer confirmed the bug in the GitHub issue, stating: "[I]f you feed it an infinitely deep blockquote input it will crash. (...) [T]his is a duplicate of an old bug that I've been working on," indicating awareness and ongoing remediation effort (GitHub Issue). The vulnerability was discovered and reported by the SynFuzz research team. Coverage has been limited to vulnerability aggregator sites and automated feeds; no significant broader media or social media discussion has been identified.