CVE-2020-26148: MD4C Project MD4C

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

md_push_block_bytes in md4c.c in md4c 0.4.5 allows attackers to trigger use of uninitialized memory, and cause a denial of service (e.g., assertion failure) via a malformed Markdown document.

Affected products

• MD4C Project MD4C: version 0.4.5 only

Published 2020-09-30. Last modified 2026-06-17.