The vulnerability stems from uncontrolled recursion in the markdown.c compile function of Orc discount, triggered by feeding the parser an infinitely deep blockquote. This leads to a stack exhaustion and subsequent application crash. The weakness indicates inadequate input validation, allowing the denial‑of‑service effect to occur locally without exposing data or code execution capabilities.

The affected product is Orc discount Markdown Handler, with all releases up to version 3.0.1.2 listed as vulnerable. No newer version is documented as fixed, so users of any version within that range are at risk.

The CVSS score of 4.8 reflects moderate severity, and the vulnerability is not listed in the CISA KEV catalog, implying limited public exploitation visibility. The attack requires local access to the system running Orc discount. Exploitation results in a crash, providing only a local denial‑of‑service condition without elevation of privileges or data compromise.