Quick answers
- Is CVE-2026-86303 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86303 being exploited in the wild.
- How severe is CVE-2026-86303?
- High severity, with a CVSS score of 7.3, published 7 September 2026.
- Which products and versions are affected?
- 92181 markdown up to commit 058cab0cb7fb245a0ccc6b8446963ff8d573558f.
- Is there a fix for CVE-2026-86303?
- A patch was published on 2026-09-07: Fix merged in commit c000d2f9cf390c315378d3717cf20911cf3e80a6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-86303 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-86303?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an out-of-bounds read in the lds() function of md.c, a static inline helper function used during markdown parsing. The flaw occurs when processing exact-length input at buffer boundaries, allowing reads past the intended buffer limits. The attack is network-accessible, requiring only maliciously crafted markdown input; no authentication or user interaction is required. An attacker can exploit this to read adjacent memory contents or trigger denial of service. A patch (commit c000d2f9cf390c315378d3717cf20911cf3e80a6) has been released and should be applied immediately.
Affected products
- 92181 markdown up to commit 058cab0cb7fb245a0ccc6b8446963ff8d573558f
Timeline
- 2026-09-07: disclosed: CVE-2026-86303 published
- 2026-09-07: patched: Fix merged in commit c000d2f9cf390c315378d3717cf20911cf3e80a6