In rdiscount versions 1.3.1.1 through before 2.2.7.4 a signed length truncation bug allows an attacker to craft Markdown data larger than INT_MAX. The bug truncates the length to a signed integer before parsing, causing the parser to read past the end of the supplied buffer and crash the process. The crash results in a denial‑of‑service condition because the process terminates unexpectedly. This issue is identified as CWE‑125, an out‑of‑bounds read. The vulnerability enables attackers to disrupt the availability of any service or application that loads Markdown using the affected rdiscount library, potentially causing downtime or requiring a restart. The impact is limited to denial of service; confidentiality or integrity are not directly compromised.

The affected software is David Fstr’s rdiscount Markdown implementation. Versions from 1.3.1.1 up to but not including 2.2.7.4 are vulnerable. Any deployment using an older rdiscount package, regardless of operating system, is at risk if Markdown input is processed without size validation. Upstream releases after 2.2.7.4 include the fix, so the risk is confined to older releases. Users who rely on rdiscount in web servers, static site generators, content management systems, or any other tooling that renders Markdown must review their dependency versions.

The CVSS score of 5.9 indicates a moderate severity vulnerability. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, an attacker can trigger a crash by supplying a specially crafted Markdown document that exceeds the 32‑bit integer limit, causing the parser to over‑read. The attack requires limited knowledge of the input format and does not rely on additional privileges; it can be executed from any source that can feed Markdown data into the parser. The risk is thus significant in scenarios where continuous availability is critical. With the lack of reported real‑world exploitation and no known active exploits, the likelihood of immediate targeting is uncertain, but the potential for service disruption justifies timely remediation.