The vulnerability resides in the SmartypantsRenderer of the gomarkdown/markdown library; when parsing a malformed input that contains a '<' character which is not closed by a '>' later in the text, the renderer performs an out-of-bounds read or may trigger a panic. This weakness is classified as CWE‑125 and CWE‑1286, an undefined behavior caused by reading memory beyond allocated bounds.

The affected product is the Go library github.com/gomarkdown/markdown, which is used by developers to parse Markdown content and render it as HTML. Affected versions are those prior to the patch introduced by commit 759bbc3e32073c3bc4e25969c132fc520eda2778; the CVE data does not list specific version numbers.

The CVSS score of 7.5 indicates a high severity attack, and although the EPSS score is 0.0005 (<1%), the absence of a KEV listing suggests that the vulnerability is not currently widely exploited. However, any application that incorporates the gomarkdown/markdown library to render user-supplied Markdown, especially via SmartypantsRenderer, represents a potential attack surface. An attacker could supply specially crafted Markdown content to trigger the out‑of‑bounds read, causing a crash or, in some exploitation contexts, leaking memory contents if the runtime environment allows such access.